CVE-2015-1867
HighSummary
Pacemaker before version 1.1.13 does not properly evaluate added nodes, allowing remote read-only users to gain privileges via an acl command.
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to privilege escalation by remote users.
Recommendation
It is recommended to upgrade Pacemaker to version 1.1.13 or later to mitigate this vulnerability.
Other vulnerabilities in Pacemaker
See all- CVE-2016-7797High
Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
- CVE-2026-10649High
A flaw was found in Pacemaker where an unauthenticated remote attacker can exploit an integer overflow in the remote message decompression process. By sending a specially crafted compressed message before authentication, an attacker can cause memory corruption, leading to denial of service (DoS) in the CIB remote listener.
Original NVD description (English source)
Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.