Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor.

cumin: authentication bypass flaws cumin: weak session keys cumin: multiple XSS flaws cumin: SQL injection flaw cumin: DoS via large image requests cumin: CSRF flaw cumin: session fixation flaw cumin: allows for editing internal Condor job attributes condor: local users can abort any idle jobs condor: lock directories created mode 0777 allow for FS-based authentication challenge bypass condor: GIVE_REQUEST_AD leaks privileged ClaimId information