{"id":"CVE-2010-2496","url":"https://www.cyber-defence.io/tools/cve/CVE-2010-2496","generatedAt":"2026-10-27T19:53:49.445Z","title":"stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations.","description":"stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.","published":"2021-10-18T13:15:09.000Z","lastModified":"2026-06-16T23:20:52.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-287"],"affected":["clusterlabs/cluster glue","clusterlabs/pacemaker"],"epss":{"score":0.00233,"percentile":0.14052,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496","tags":["Issue Tracking","Mailing List","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2010-2496","tags":["Issue Tracking","Mailing List","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-2496","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}