What is CVE-2017-2627?

CVE-2017-2627 is a high-severity vulnerability in Openstack Tripleo-Common, classified under Path Traversal. CVSS score: 8.2/10. Published 2018-08-22.

How severe is CVE-2017-2627?

High severity. CVSS v3 base score is 8.2 out of 10.

Path Traversal in Openstack Tripleo-Common

CVE-2017-2627

A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with '..' and it grants full passwordless root access to the validations user.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.007 (47.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Openstack Tripleo-common
Red Hat Openstack-tripleo-common — versions As shipped with Red Hat Openstack Enterprise 10 and 11
Redhat Openstack — versions 10, 11

Weakness classification (CWE)

CWE-22 — Path Traversal

References

secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2017-2627?: CVE-2017-2627 is a high-severity vulnerability in Openstack Tripleo-Common, classified under Path Traversal. CVSS score: 8.2/10. Published 2018-08-22.
How severe is CVE-2017-2627?: High severity. CVSS v3 base score is 8.2 out of 10.