CVE-2020-35458
Published
CVSS v3
9.8
CRITICAL
CVSS v2
10
HIGH
Affected
1
PROJECT
Description
An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.
A web-based GUI for managing and monitoring the Pacemaker High-Availability cluster resource manager
GitHub