Vulnerability Details : CVE-2015-3983
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
Products affected by CVE-2015-3983
- cpe:2.3:a:fedora:pacemaker_configuration_system:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-3983
0.41%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-3983
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2015-3983
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-3983
-
http://rhn.redhat.com/errata/RHSA-2015-0980.html
RHSA-2015:0980 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2015-0990.html
RHSA-2015:0990 - Security Advisory - Red Hat Customer Portal
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159374.html
[SECURITY] Fedora 20 Update: pcs-0.9.115-3.fc20
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159412.html
[SECURITY] Fedora 22 Update: pcs-0.9.139-4.fc22
-
http://www.securityfocus.com/bid/74682
pcs daemon CVE-2015-3983 Remote Information Disclosure Vulnerability
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159401.html
[SECURITY] Fedora 21 Update: pcs-0.9.137-4.fc21
-
https://bugzilla.redhat.com/attachment.cgi?id=1009855
Jump to