CVE-2014-0643 EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass a...
HighCVSS 7.6
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emc rsa netwitness | < 9.8.5.19 | 9.8.5.19 |
| emc rsa security analytics | >= 10.2, < 10.2.4 | 10.2.4 |
| emc rsa security analytics | >= 10.3, < 10.3.2 | 10.3.2 |
References
- 20140512 ESA-2014-027: RSA NetWitness and RSA Security Analytics Authentication Bypass Vulnerability mailing-list third-party-advisory