ALT-PU-2018-2207-1
Closed vulnerabilities
Published: 2018-07-27
BDU:2019-04067
Уязвимость функции ssedb_search_user_by_upn_res() сервиса управления доступом к удаленным каталогам и механизмам аутентификации sssd, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Severity: MEDIUM (6.5)
Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References:
Published: 2018-07-27
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2017-12173
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.
Severity: HIGH (8.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References: