CVE-2018-1079
Public on 2018-04-12
Modified on 2018-04-26
Description
It was found that the REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
CVSS v3 Base Score
See breakdown
