CVE-2011-3172 — Missing Critical Step in Authentication in Linux Enterprise

CWE-304 — Missing Critical Step in AuthenticationCWE-2643 documents3 sources
Severity
9.8CRITICALNVD
CNA5.4
EPSS
0.2%
top 55.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Suse Linux EnterpriseSuse Linux Enterprise Server
Timeline
PublishedJun 8
Latest updateMay 13

Description

A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5suse/suse_linux_enterpriseunspecified — 12

🔴Vulnerability Details

2
GHSA
GHSA-jv5w-jhcc-wx4g: A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled↗2022-05-13
▶
CVEList
unix2_chkpwd do not check for a valid account↗2018-06-08
▶
CVE-2011-3172 — Missing Critical Step in Authentication | cvebase