CVE-2023-49938

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-49938
An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html Mailing List Vendor Advisory
https://www.schedmd.com/security-archive.php Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*
cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*
History

03 Jan 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/ -

19 Dec 2023, 16:08

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2
CWE NVD-CWE-Other
References () https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - () https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - Mailing List, Vendor Advisory
References () https://www.schedmd.com/security-archive.php - () https://www.schedmd.com/security-archive.php - Vendor Advisory
Summary
  • (es) Se descubrió un problema en SchedMD Slurm 22.05.x y 23.02.x. Hay un control de acceso incorrecto: un atacante puede modificar su lista de grupos extendidos que se usa con el subsistema sbcast y abrir archivos con un conjunto no autorizado de grupos extendidos. Las versiones fijas son 22.05.11 y 23.02.7.
First Time Schedmd
Schedmd slurm
CPE cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*

14 Dec 2023, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-14 05:15

Updated : 2024-01-03 03:15

NVD link : CVE-2023-49938

Mitre link : CVE-2023-49938

CVE.ORG link : CVE-2023-49938

JSON object : View

Products Affected

schedmd

  • slurm
CWE
NVD-CWE-Other