CVE-2017-2661
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due...
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
CVE-2017-2661- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
CVE-2017-2661- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2017-11809 No score
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
EUVD-2017-11809- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc8r-mjjf-5j6v
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due...
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
GHSA-qc8r-mjjf-5j6v- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
CVE-2017-2661- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-2661
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
DEBIAN-CVE-2017-2661- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-2661
ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
- Record
UBUNTU-CVE-2017-2661- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-7614-1 No score
pcs vulnerabilities
Cedric Buissart discovered that pcs did not correctly handle certain parameters. An attacker could possibly use this issue to leak sensitive information or elevate their privileges. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-1086)
Ondrej Mular discovered that pcs did not correctly handle Unix socket permissions. An attacker could possibly use this issue to elevate their privileges. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2735)
It was discovered that pcs did not correctly handle PAM authentication. An attacker could possibly use this issue to bypass authentication mechanisms. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-1049)
It was discovered that pcs did not correctly handle the validation of Node names. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2661)
- Record
USN-7614-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pcsDebian:12 |
before 0.9.155+dfsg-2 | 0.9.155+dfsg-2 |
pcsDebian:13 |
before 0.9.155+dfsg-2 | 0.9.155+dfsg-2 |
pcsDebian:14 |
before 0.9.155+dfsg-2 | 0.9.155+dfsg-2 |
pcsUbuntu:Pro:16.04:LTS |
before 0.9.149-1ubuntu1.1+esm1, plus listed versions 0.9.149-10.9.149-1ubuntu10.9.149-1ubuntu1.1 |
0.9.149-1ubuntu1.1+esm1 |
pcsUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 0.9.149-1ubuntu1.1+esm1, plus listed versions 0.9.149-10.9.149-1ubuntu10.9.149-1ubuntu1.1 |
0.9.149-1ubuntu1.1+esm1 |
pcsUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 0.10.4-3ubuntu0.1~esm1, plus listed versions 0.10.2-10.10.4-20.10.4-2ubuntu10.10.4-3 |
0.10.4-3ubuntu0.1~esm1 |
pcsUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 0.10.11-2ubuntu3+esm1, plus listed versions 0.10.8-1ubuntu10.10.11-2ubuntu20.10.11-2ubuntu3 |
0.10.11-2ubuntu3+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2661 is a medium vulnerability (CVSS 6.1) in Clusterlabs Pcs, published March 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in pcs 0.9.155+dfsg-2.