Auth bypass in EMC Rsa Netwitness
CVE-2014-0643
EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
Vulnerability class: Broken Authentication
EPSS: 0.024 (81.9th percentile) — read the EPSS interpretation.
Affected products
- Emc Rsa_netwitness
- Emc Rsa_security_analytics
- N/a — versions n/a
Weakness classification (CWE)
References
- security_alert@emc.com (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)