VulnerabilityModified
CVE-2012-4494
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.
MEDIUM 4.3EPSS 1.08%
Does this matter?
Lower severity and a low EPSS score (1.08%). Track it; it rarely justifies an emergency change on its own.
Description
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.08% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- niif/shibb auth
- Source
- secalert@redhat.com
References
- http://drupal.org/node/1493244
- http://drupal.org/node/1719392Vendor Advisory
- http://drupalcode.org/project/shib_auth.git/commitdiff/2032f0a
- http://www.openwall.com/lists/oss-security/2012/10/04/6
- http://www.openwall.com/lists/oss-security/2012/10/07/1
- http://drupal.org/node/1493244
- http://drupal.org/node/1719392Vendor Advisory
- http://drupalcode.org/project/shib_auth.git/commitdiff/2032f0a
- http://www.openwall.com/lists/oss-security/2012/10/04/6
- http://www.openwall.com/lists/oss-security/2012/10/07/1
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.