CVE-2020-35459: An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via…

PriorityP339high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.68%

48.7th percentile

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
clusterlabs	crmsh	<= 4.2.1	—
clusterlabs	crmsh	>= 0 < 4.2.1-2	4.2.1-2
clusterlabs	crmsh	>= 0 < 4.2.1-2	4.2.1-2
clusterlabs	crmsh	>= 0 < 4.2.1-2	4.2.1-2
clusterlabs	crmsh	>= 0 < 4.2.1-2	4.2.1-2
clusterlabs	crmsh	0 – 4.2.1	—
debian	crmsh	< crmsh 4.2.1-2 (bookworm)	crmsh 4.2.1-2 (bookworm)
debian	debian_linux	—	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

osv7.8HIGH

vendor_debian7.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.