What is the CVSS score of CVE-2015-1848?

CVE-2015-1848 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 1.2%.

Is there a public PoC exploit available for CVE-2015-1848?

Yes, a public proof-of-concept exploit is available for CVE-2015-1848. Prioritise patching immediately. EPSS: 1.2%.

Pacemaker Configuration System CVE-2015-1848

MEDIUM

Cryptographic Issues (CWE-310)

2015-05-14 secalert@redhat.com

Information Disclosure Pacemaker Configuration System Enterprise Linux High Availability Enterprise Linux High Availability Eus Enterprise Linux Resilient Storage Enterprise Linux Resilient Storage Eus

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

May 14, 2015 - 14:59 cve.org

MEDIUM 6.8

DescriptionCVE.org

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

AnalysisAI

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag. Affected products include: Fedora Pacemaker Configuration System, Redhat Enterprise Linux High Availability, Redhat Enterprise Linux High Availability Eus, Redhat Enterprise Linux Resilient Storage, Redhat Enterprise Linux Resilient Storage Eus.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.