It was reported that pcs package is vulnerable to command injection with root privileges. A user supplied string is used to in running a system command. If the user uses escape characters they can run a command as the root user on the system.

To do this the user must already have access to login to pcsd (Be a member of the hacluster group).

It was reported that it's possible to get access as a different user when using pcsd (the pcs web UI) due to using a variable which is global to the server instead of the connection to validate usernames.

Scenario is following: User A sends a command to pcsd, after the connection is made and authentication happens, (but before any security checks are done), User B connects and authenticates. User A could potentially get access based on User B's permissions.

To take advantage of this the user must have access to login to pcsd.

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.