CVE-2014-0643
Published May 16, 2014
Last updated 6 years ago
Overview
- Description
- EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
- Source
- security_alert@emc.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.6
- Impact score
- 10
- Exploitability score
- 4.9
- Vector string
- AV:N/AC:H/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- CWE-287
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:emc:rsa_netwitness:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDD02B27-0AB5-48D1-99E8-AE5DA1A85E05",
"versionEndExcluding": "9.8.5.19"
},
{
"criteria": "cpe:2.3:a:emc:rsa_security_analytics:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B1C2730-8BBB-4A38-AC1D-02D775DA635C",
"versionEndExcluding": "10.2.4",
"versionStartIncluding": "10.2"
},
{
"criteria": "cpe:2.3:a:emc:rsa_security_analytics:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7B8C7FB-62E8-4703-924B-A7D74A9305DB",
"versionEndExcluding": "10.3.2",
"versionStartIncluding": "10.3"
}
],
"operator": "OR"
}
]
}
]