Every CVE Search/ Get API key

CVE-2015-1848

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an...

6.8 MediumFix available

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Exploit likelihood

2.41%Up 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Record
CVE-2015-1848
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Record
CVE-2015-1848
Updated
2026-11-02
EUVDEUVD-2015-1959 No score

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Record
EUVD-2015-1959
Updated
2026-11-03
GitHub AdvisoriesGHSA-wqr4-6q63-33fp No score

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an...

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

Record
GHSA-wqr4-6q63-33fp
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pcs
Red Hat:enterprise_linux:7::server
 before 0:0.9.137-13.el7_1.2
0:0.9.137-13.el7_1.2
pcs-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.9.137-13.el7_1.2
0:0.9.137-13.el7_1.2
python-clufter
Red Hat:enterprise_linux:7::server
 before 0:0.9.137-13.el7_1.2
0:0.9.137-13.el7_1.2
pcs
Red Hat:enterprise_linux:6::server
 before 0:0.9.123-9.el6_6.2
0:0.9.123-9.el6_6.2
pcs-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:0.9.123-9.el6_6.2
0:0.9.123-9.el6_6.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-1848 is a medium vulnerability (CVSS 6.8) in Fedora Pacemaker Configuration System, published May 14, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.41%, the 84th percentile. Fixed in pcs 0:0.9.137-13.el7_1.2.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open