CVE-2024-48936
Medium
Description
SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.
SeverityMedium
CVSS5.0
Exploit probability—
ProductSchedmd Slurm
PublishedOct 28, 2024
First seenOct 28, 2024
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- schedmd slurm24.05.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schedmd slurm | v < 24.05.4 | 24.05.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.