CVE-2024-9313 — Improper Authentication in LTD Authd

CWE-287 — Improper Authentication5 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.5%
top 34.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Canonical LTD AuthdGithub.com Ubuntu AuthdCanonical Authd
Timeline
PublishedOct 3
Latest updateOct 9

Description

Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDcanonical/authd< 0.3.5
▶CVEListV5canonical_ltd/authd< 0.3.5
▶Gogithub.com/ubuntu_authd0.1.0 — 0.3.5+2

🔴Vulnerability Details

4
OSV
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd↗2024-10-09
▶
OSV
PAM module may allow accessing with the credentials of another user↗2024-10-03
▶
CVEList
CVE-2024-9313: Authd PAM module before version 0↗2024-10-03
▶
GHSA
PAM module may allow accessing with the credentials of another user↗2024-10-03
▶
CVE-2024-9313 — Improper Authentication in LTD Authd | cvebase