What is the CVSS score of CVE-2015-5190?

CVE-2015-5190 has a CVSS 2.0 base score of 8.5 (High). CVSS vector: AV:N/AC:M/Au:S/C:C/I:C/A:C. EPSS exploitation probability: 0.6%.

Pacemaker Corosync Configuration System CVE-2015-5190

HIGH

Command Injection (CWE-77)

2015-09-03 secalert@redhat.com

Command Injection Pacemaker Corosync Configuration System

8.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:M/Au:S/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:S/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 03, 2015 - 14:59 cve.org

HIGH 8.5

DescriptionCVE.org

The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.

AnalysisAI

The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL. Affected products include: Pacemaker\/Corosync Configuration System Project Pacemaker\/Corosync Configuration System.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.