‹ Volver al listado

CVE-2023-27486

Estado: ModificadaAlta (8.8)—
Gravedad8.8Alta · CVSS 3.1
Probabilidad de explotación0.85 %mayor que el 58 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

xCAT es un conjunto de herramientas para el despliegue y la administración de clústeres de computación. En las versiones anteriores a la 2.16.5, si se configuran zonas como mecanismo para proteger los clústeres en xCAT, es posible que un usuario root local de un nodo obtenga credenciales para conectarse por SSH a cualquier nodo de cualquier zona, excepto al nodo de gestión de la zona predeterminada. Las zonas de xCAT no están habilitadas de forma predeterminada. Solo se ven afectados los usuarios que utilizan la función opcional de zonas.

Leer descripción completaMostrar menos

Todas las versiones de xCAT anteriores a xCAT 2.16.5 son vulnerables. Este problema se ha corregido en xCAT 2.16.5. Los usuarios que utilicen zonas deben actualizar a la 2.16.5. Los usuarios que no puedan actualizar pueden mitigar el problema deshabilitando las zonas o aplicando al nodo de gestión la corrección contenida en el commit `85149c37f49`.

Traducción automática del texto original de NVD (en inglés).

CVSS

Puntuación base
8.8
Versión
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
0.85 %
Percentil entre todas las CVEs puntuadas
58
Fecha de la puntuación
20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Xcat Project — Xcat

CWE

Referencias

Mostrar las 8 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-27486",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27486",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-25T14:29:44.673725Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xcat2",
          "product": "xcat-core",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.16.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-03-08T19:15:11.073",
  "references": [
    {
      "url": "https://github.com/xcat2/xcat-core/issues/7246",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/pull/7247",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/pull/7247/commits/85149c37f49dbca7bd85f1f586960315604fc024",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/security/advisories/GHSA-hpxg-7428-6jvv",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/issues/7246",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/pull/7247",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/pull/7247/commits/85149c37f49dbca7bd85f1f586960315604fc024",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/xcat2/xcat-core/security/advisories/GHSA-hpxg-7428-6jvv",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obtain credentials to SSH to any node in any zone, except the management node of the default zone. XCAT zones are not enabled by default. Only users that use the optional zone feature are impacted. All versions of xCAT prior to xCAT 2.16.5 are vulnerable. This problem has been fixed in xCAT 2.16.5. Users making use of zones should upgrade to 2.16.5. Users unable to upgrade may mitigate the issue by disabling zones or patching the management node with the fix contained in commit `85149c37f49`."
    }
  ],
  "lastModified": "2026-06-17T05:45:18.737",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xcat_project:xcat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1E99110-D3F9-49CA-84F9-DB7E457AEE59",
              "versionEndExcluding": "2.16.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}