CVE-2020-35458

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
clusterlabshawk
2.2.0-12
clusterlabshawk
2.3.0-12
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2021/01/12/3
https://bugzilla.suse.com/show_bug.cgi?id=1179998
https://github.com/ClusterLabs/hawk/releases
https://www.openwall.com/lists/oss-security/2021/01/12/3
http://www.openwall.com/lists/oss-security/2021/01/12/3
https://bugzilla.suse.com/show_bug.cgi?id=1179998
https://github.com/ClusterLabs/hawk/releases
https://www.openwall.com/lists/oss-security/2021/01/12/3