PacketFence Bypass Authentication Vulnerability

PacketFence is an open source network access control solution. A security vulnerability exists in the 'checkpassword' function in the html/admin/login.php file in versions prior to PacketFence 3.0.2. A remote attacker can exploit this vulnerability to bypass authentication with the help of an emp...

Authentication flaw

The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...

Authentication flaw

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...

CVE-2011-4068

The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...

CVE-2011-4068

The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...

CVE-2011-4069

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...

CVE-2011-4069

PacketFence is affected through the web UI file html/admin/login.php. The vulnerability allows LDAP injection via a crafted username, enabling bypass of authentication in versions before 3.0.2. The issue is documented across multiple sources (NVD/CNVD) with a consistent description: an LDAP injec...

CVE-2011-4068

The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...

CVE-2011-4069

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...

CVE-2011-4068

PacketFence before 3.0.2 is affected by an authentication bypass in the check_password function (html/admin/login.php). An unauthenticated remote attacker can bypass login with an empty password, gaining access to the system. Multiple sources reference PacketFence

CVE-2011-4069: Improper Neutralization of Special Elements used in an LDAP Query

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username...

CVE-2011-4068: Improper Authentication

The checkpassword function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password...

[PacketFence v4.0] Open Source network access control (NAC)

PacketFence is a fully supported, trusted, Free and Open Source network access control NAC solution. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices,...

CVE-2012-4742

The webnoderegister function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-4741

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute...

CVE-2012-4740

Cross-site scripting XSS vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Authentication flaw

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute...

Server side request forgery (ssrf)

The webnoderegister function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-4742

CVE-2012-4742 affects PacketFence, specifically the web_node_register function in web.pm prior to version 3.0.2. The collection of connected documents confirms a remote code execution possibility via unspecified vectors. The Red Hat advisory and NVD entry corroborate the vulnerability description...