NVD

Id
35121  
Name
CVE-2014-7828  
Description
FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.  
Reject
 
CVSS Version
2  
CVSS Score
3.5  
Severity
Low  
CVSS Base Score
3.5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-11-19  
Modified Date
2014-11-19  
Seq
2014-7828  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
179769 35121 CVE-2014-7828 FEDORA-2014-14427  View
179770 35121 CVE-2014-7828 http://www.freeipa.org/page/Releases/4.1.1  View
179771 35121 CVE-2014-7828 70932  View
179772 35121 CVE-2014-7828 freeipa-otp-sec-bypass(98500)  View
179773 35121 CVE-2014-7828 https://bugzilla.redhat.com/show_bug.cgi?id=1160871  View
179774 35121 CVE-2014-7828 https://fedorahosted.org/freeipa/ticket/4690  View
179775 35121 CVE-2014-7828 [Freeipa-devel] 20141105 [PATCH 0076] Ensure that a password exists after OTP validation  View
179776 35121 CVE-2014-7828 [Freeipa-users] 20141105 ATTN: CVE-2014-7828  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16673 JVNDB-2014-005548 FreeIPA における二要素認証のパスワード要求を回避される脆弱性 FreeIPA は、2FA が有効になっている場合、二要素認証のパスワード要求を回避され、匿名バインドを誘発される脆弱性が存在します。 CVE-2014-7828 75121 CVE-2014-7828 35121 3.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005548.html 2014-11-05 2014-11-20 View