CRITICAL🇵🇱 Wersja polska

CVE-2011-4069

CVSS 9.8v3.0pub. 2018-02-01upd. 2024-11-21

html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Packetfence

    APP
    Packetfence
    ≤ 3.0.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2011-4068CRITICAL9.8PL ✓same product

PacketFence – pominięcie uwierzytelnienia przez puste hasło (Auth Bypass)

CVE-2012-4742HIGH7.5same product

The web_node_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute a...

CVE-2012-4740MEDIUM4.3same product

Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attac...

CVE-2012-4741MEDIUM5.0same product

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication fo...