by Kastro
Paper/Archive/CVE-2020-27780

CVE-2020-27780

redhat — A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users.

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.3.803 × 2016.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

Affected

ProductAffectedFixed inSource
pampam 1.5.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1901094