Описание
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.
Ссылки
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:o:suse:yast2:*:*:*:*:*:*:*:*
Одно из
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*
EPSS
Процентиль: 63%
0.00454
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-255
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.
EPSS
Процентиль: 63%
0.00454
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-255