unix2_chkpwd do not check for a valid account

published 2018-06-08 8 y ago modified 2026-06-16 4 mo ago also EUVD-2011-3139

cvss: 5.4; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.

Patch / fix

fixed in 1 distros 2

SUSE SUSE Linux Enterprise 12

suse opensuse

pam-modules SLES for SAP 11 SP4, SLES 11 SP4 11-1.27.3.1

suse advisories SUSE-SU-2018:1760-1

pam-modules openSUSE Tumbleweed 12.1-27.4

opensuse advisories openSUSE-SU-2024:10043-1

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	5.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

SUSE SUSE Linux Enterprise

Classification

Weakness

CWE-304 Missing Critical Step in Authentication
CWE-264 Permissions, Privileges, and Access Controls

References

Sources

CVE List CVE-2011-3172
NVD CVE-2011-3172

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary