What is CVE-2020-27780?

CVE-2020-27780 is a critical-severity vulnerability in Linux-Pam, classified under Improper Authentication. CVSS score: 9.8/10. Published 2020-12-18.

How severe is CVE-2020-27780?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Linux-Pam

CVE-2020-27780

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

Vulnerability class: Broken Authentication

EPSS: 0.020 (78.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Linux-pam
N/a Pam — versions pam 1.5.1

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2020-27780?: CVE-2020-27780 is a critical-severity vulnerability in Linux-Pam, classified under Improper Authentication. CVSS score: 9.8/10. Published 2020-12-18.
How severe is CVE-2020-27780?: Critical severity. CVSS v3 base score is 9.8 out of 10.