CVE-2014-3879

Katalog CVE

CVSS 9.8 · Critical EPSS 2,7%

Kerentanan Improper Authentication pada freebsd. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login (1) without a password or (2) with an incorrect password.

Rincian

Terbit di NVD

18 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.securitytracker.com/id/1030330 patch · vdb entry · advisory vendor
• http://www.freebsd.org/security/advisories/FreeBSD-SA-14:13.pam.asc patch · advisory pihak ketiga
• http://www.securityfocus.com/bid/67808 advisory pihak ketiga · vdb entry
• http://www.openpam.org/browser/openpam/trunk/HISTORY release notes