CVE-2022-1049: clusterlabs pcs Improper Authentication
Vulnerability summary
CVE-2022-1049 is a high (CVSS 8.8) Improper Authentication vulnerability in clusterlabs pcs. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 25-03-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.97%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- pcs< 0.10.1-2+deb10u1 | < 0.11.3-1
- debian_linuxEOL10.0 | 11.0
Redhat2 products
- pcs< 0:0.10.14-5.el8 | < 0:0.11.3-4.el9
- pcs-snmp< 0:0.10.14-5.el8 | < 0:0.11.3-4.el9
Clusterlabs1 product
- pcs≤ 0.11.2
Ubuntu1 product
- pcs< 0.10.11-2ubuntu3+esm1
4 vendors · 6 products
References
56 links
- lists.debian.org/debian-lts-announce/2022/09/msg00017.htmlMailing ListX Refsource MLISTThird Party Advisory
