VULNERABILITY INTELLIGENCE

CVE-2022-1049

CVSS score8.8 HIGH

EPSS probability1.97%

CISA KEVNot currently listed

Published2022-03-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.

Weakness classification

secalert@redhat.com: CWE-287
nvd@nist.gov: CWE-287

Primary references

secalert@redhat.com — Exploit, Third Party Advisory
secalert@redhat.com — Mailing List, Third Party Advisory
secalert@redhat.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory