The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPacketfence
APPPacketfence≤ 3.0.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Powiązane podatności
CVE-2011-4069CRITICAL9.8ten sam produkt
html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and...
CVE-2012-4742HIGH7.5ten sam produkt
The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute a...
CVE-2012-4740MEDIUM4.3ten sam produkt
Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attac...
CVE-2012-4741MEDIUM5.0ten sam produkt
The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication fo...