Lucene search

RedhatCVE-2012-4494

HistoryOct 31, 2012 - 4:55 p.m.

CVE-2012-4494

2012-10-3116:55:03

CWE-264

redhat

web.nvd.nist.gov

cve-2012-4494

shibboleth

authentication module

drupal

remote access vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

7.3

Confidence

Low

EPSS

0.002

Percentile

57.0%

JSON

The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.

Affected configurations

Nvd

Node

niifshibb_authMatch7.x-4.0

AND

drupaldrupalMatch-

VendorProductVersionCPE
niifshibb_auth7.x-4.0cpe:2.3:a:niif:shibb_auth:7.x-4.0:*:*:*:*:*:*:*
drupaldrupal-cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
niif	shibb_auth	7.x-4.0	cpe:2.3:a:niif:shibb_auth:7.x-4.0:::::::*
drupal	drupal	-	cpe:2.3:a:drupal:drupal:-:::::::*

References

drupal.org/node/1493244

drupal.org/node/1719392

drupalcode.org/project/shib_auth.git/commitdiff/2032f0a

www.openwall.com/lists/oss-security/2012/10/04/6

www.openwall.com/lists/oss-security/2012/10/07/1

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

7.3

Confidence

Low

EPSS

0.002

Percentile

57.0%

JSON

Related for CVE-2012-4494