Auth bypass in Novell Access Manager

CVE-2009-4879

The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.

Vulnerability class: Broken Authentication

EPSS: 0.010 (60.5th percentile) — read the EPSS interpretation.

Affected products

Novell Access_manager — versions 3
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (x_refsource_CONFIRM)