CVE-2010-2940: The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled…

PriorityP336medium5.1CVSS 2.0

AVNACHAuNCPIPAP

EPSS

2.02%

78.8th percentile

The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	sssd	< sssd 1.2.1-4 (bookworm)	sssd 1.2.1-4 (bookworm)
fedoraproject	sssd	—	—
fedoraproject	sssd	>= 0 < 1.2.1-4	1.2.1-4
fedoraproject	sssd	>= 0 < 1.2.1-4	1.2.1-4
fedoraproject	sssd	>= 0 < 1.2.1-4	1.2.1-4
fedoraproject	sssd	>= 0 < 1.2.1-4	1.2.1-4

CVSS provenance

nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P

osv5.1MEDIUM

vendor_debian5.1MEDIUM

vendor_redhat5.1MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.