CVE-2014-0643

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.

Score

CVSS 2.0 7.6 High

Status

Modified - security_alert@emc.com

Published

2014-05-16

Last modified

2024-08-06

Weaknesses

CWE-287

Affected products

• Rsa Netwitness (Emc)
• Rsa Security Analytics (Emc)

References

• http://archives.neohapsis.com/archives/bugtraq/2014-05/0052.html