← Vulnerability feed

Vulnerability record · CVE-2017-2661 · published 12 March 2018

CVE-2017-2661: Clusterlabs pcs cross-site scripting vulnerability

Clusterlabs · Pcs

ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.

6.1 CVSS 3.0 Medium EPSS 1.2% · top 33.5% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=1428948 Issue TrackingPatchThird Party Advisory
https://github.com/ClusterLabs/pcs/commit/1874a769b5720ae5430f10c6cedd234430bc703f Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1428948 Issue TrackingPatchThird Party Advisory
https://github.com/ClusterLabs/pcs/commit/1874a769b5720ae5430f10c6cedd234430bc703f Patch

Track CVE-2017-2661 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-2319Clusterlabs pcs vulnerabilityIt was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix…EPSS 0.97%8.8CVE-2022-1049Clusterlabs pcs improper authentication vulnerabilityA flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to logi…EPSS 2.0%8.8CVE-2016-0720Clusterlabs pcs cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.EPSS 1.4%8.1CVE-2016-0721Clusterlabs pcs vulnerabilitySession fixation vulnerability in pcsd in pcs before 0.9.157.EPSS 2.3%7.8CVE-2022-2735Clusterlabs pcs incorrect default permissions vulnerabilityA vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between…EPSS 0.32%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed6.1CVE-2025-66376Zimbra Collaboration Classic UI stored XSS via CSS @import in emailZimbra Collaboration Suite 10 before 10.0.18 and 10.1 before 10.1.13 allows stored cross-site scripting in the Classic UI through CSS @import directi…KEVEPSS 20%analysed

Source: NIST National Vulnerability Database (record CVE-2017-2661), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.