ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663)

  - ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to     improper validation of Node name field when creating new cluster or adding existing cluster.
    (CVE-2017-2661)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pcs: Cross-Site Request Forgery in web UI (CVE-2016-0720)

  - Session fixation vulnerability in pcsd in pcs before 0.9.157. (CVE-2016-0721)

  - ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to     improper validation of Node name field when creating new cluster or adding existing cluster.
    (CVE-2017-2661)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

- Security fix for CVE-2017-2661: Improper node name field     validation when creating clusters leads to XSS

  - Re-added support for clufter as it is now available for     Python 3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199225	RHEL 7 : pcs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199124	RHEL 6 : pcs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196075	RHEL 7 : pcs (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196059	RHEL 6 : pcs (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
99176	Fedora 24 : pcs (2017-7accc8010b)	Nessus	Fedora Local Security Checks	medium
99175	Fedora 25 : pcs (2017-71e69a691b)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-2661

medium

Tenable Plugins

high

high

high

medium

medium

medium