#VU38458 Input validation error in Pulp - CVE-2015-5153


| Updated: 2020-08-08

Vulnerability identifier: #VU38458

Vulnerability risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-5153

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Pulp
Web applications / Other software

Vendor: Pulp

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Pulp: All versions

External links
https://bugzilla.redhat.com/show_bug.cgi?id=1243526

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Input validation error in Pulp