CVE-2015-5153 Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
HighCVSS 8.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pulp project pulp | All versions | No fix listed |
References
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry