CVE-2015-3983: Medium severity pacemaker/corosync configuration system vulnerability
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3983?
CVE-2015-3983 is typically classified as a medium severity vulnerability due to the lack of the HTTPOnly flag in the Set-Cookie header.
How do I fix CVE-2015-3983?
To fix CVE-2015-3983, upgrade to a version of PCS later than 0.9.137 that properly implements the HTTPOnly flag on cookies.
What are the risks associated with CVE-2015-3983?
The primary risk associated with CVE-2015-3983 is that remote attackers can access sensitive information stored in cookies through client-side scripts.
Which versions of PCS are affected by CVE-2015-3983?
CVE-2015-3983 affects PCS version 0.9.137 and earlier.
Can CVE-2015-3983 lead to data leakage?
Yes, CVE-2015-3983 can lead to data leakage by allowing unauthorized access to potentially sensitive cookie data.