CVE-2014-3879
9.8
CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, which causes the loaded policy chain to no be discarded and allows context-dependent attackers to bypass authentication via a login (1) without a password or (2) with an incorrect password.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.7% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-02-18 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| freebsd | freebsd |
References
- http://www.freebsd.org/security/advisories/FreeBSD-SA-14:13.pam.asc
- http://www.openpam.org/browser/openpam/trunk/HISTORY
- http://www.securityfocus.com/bid/67808
- http://www.securitytracker.com/id/1030330
- http://www.freebsd.org/security/advisories/FreeBSD-SA-14:13.pam.asc
- http://www.openpam.org/browser/openpam/trunk/HISTORY
- http://www.securityfocus.com/bid/67808
- http://www.securitytracker.com/id/1030330
→ the Explorer · watch your stack · NVD