CVE-2017-12197

MEDIUM

libpam4j <1.9 - Auth Bypass

Title source: llm

Description

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

Exploits (2)

nomisec WORKING POC

by dawetmaster · poc

https://github.com/dawetmaster/CVE-2017-12197-libpam4j-vulnerable

View Code ZIP pw:eip

nomisec WORKING POC

by andikahilmy · poc

https://github.com/andikahilmy/CVE-2017-12197-libpam4j-vulnerable

View Code ZIP pw:eip

References (6)

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2017:2904

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2017:2905

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2017:2906

[Issue Tracking, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=1503103

[Third Party Advisory] https://lists.debian.org/debian-lts-announce/2017/11/msg00008.html

[Third Party Advisory] https://www.debian.org/security/2017/dsa-4025

Scores

CVSS v3 6.5

EPSS 0.0051

EPSS Percentile 66.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-20 CWE-863

Status published

Products (6)

debian/debian_linux 7.0

debian/debian_linux 8.0

debian/debian_linux 9.0

libpam4j_project/libpam4j < 1.8

org.kohsuke/libpam4j 0 - 1.10Maven

redhat/enterprise_linux 6.0

Published Jan 18, 2018

Tracked Since Feb 18, 2026