CVE-2022-26110

Description

An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.447

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-45103,CVE-2021-45104,CVE-2022-26110 are affected in Htcondor 9.5.0	Windows
Vulnerabilities CVE-2021-45104,CVE-2022-26110 are affected in Htcondor 9.0.9	Windows
Vulnerabilities CVE-2022-26110 are affected in Htcondor 8.8.9	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234