Auth bypass in Packetfence
CVE-2012-4741
The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute.
Vulnerability class: Broken Authentication
EPSS: 0.014 (69.3th percentile) — read the EPSS interpretation.
Affected products
- Packetfence
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)