CVE-2022-1049

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.95% chance of exploitation in the next 30 days, 79th percentile

Published

2022-03-25

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5

References

• CVE Record
• NVD entry

Related

• CVE-2022-1047
• CVE-2022-1051
• CVE-2022-1046
• CVE-2022-1052
• CVE-2022-1045
• CVE-2022-1054