CVE-2015-5153
HighSummary
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to serious security breaches.
Recommendation
It is recommended to monitor and audit object permissions and implement additional verification mechanisms when creating objects with existing names.
Other vulnerabilities in Pulp
See all- CVE-2016-3704High
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
- CVE-2016-3112High
In Pulp before version 2.8.3, the consumer private key is written to etc/pki/pulp/consumer/consumer-cert.pem with world-readable permissions. This allows remote authenticated users to obtain the consumer private keys and escalate privileges.
- CVE-2016-3108High
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak keys or write to arbitrary files via a symlink attack.
- CVE-2013-7450High
Pulp before version 2.3.0 uses the same certificate authority key and certificate for all installations.
Original NVD description (English source)
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.