CVE-2015-1848
pcs: improper web session variable signing
Severity
ImportantRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · May 12, 2015
Updated · November 21, 2025
Description
It was found that the pcs daemon did not sign cookies containing session data that were sent to clients connecting via the pcsd web UI. A remote attacker could use this flaw to forge cookies and bypass authorization checks, possibly gaining elevated privileges in the pcsd web UI.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-347 · Improper Verification of Cryptographic Signature