CVE-2024-3019 HIGH

CVE-2024-3019: Pcp: exposure of the redis server backend allows remote command execution via pmproxy

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Weakness CWE-668
Published March 28, 2024
Last update November 20, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.

Key dates

02Disclosure timeline

March 28, 2024 CVE published
November 20, 2025 Record updated