What is CVE-2011-4338?

CVE-2011-4338 is a high-severity vulnerability in Shaman, classified under Improper Authentication. CVSS score: 7.8/10. Published 2020-02-12.

How severe is CVE-2011-4338?

High severity. CVSS v3 base score is 7.8 out of 10.

Auth bypass in Shaman

CVE-2011-4338

Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.

Vulnerability class: Broken Authentication

EPSS: 0.004 (32.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Shaman — versions 1.0.9
Shaman_project Shaman — versions 1.0.9

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

secalert@redhat.com (Mailing List, Third Party Advisory, x_refsource_MISC)
secalert@redhat.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2011-4338?: CVE-2011-4338 is a high-severity vulnerability in Shaman, classified under Improper Authentication. CVSS score: 7.8/10. Published 2020-02-12.
How severe is CVE-2011-4338?: High severity. CVSS v3 base score is 7.8 out of 10.