Описание
Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.
Ссылки
- ExploitThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitThird Party Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:shaman_project:shaman:1.0.9:*:*:*:*:*:*:*
EPSS
Процентиль: 12%
0.0004
Низкий
7.8 High
CVSS3
7.2 High
CVSS2
Дефекты
CWE-287
Связанные уязвимости
github
почти 4 года назад
Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.
EPSS
Процентиль: 12%
0.0004
Низкий
7.8 High
CVSS3
7.2 High
CVSS2
Дефекты
CWE-287