CVE-2017-7562CWE-287CWE-295

An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates

Medium · published July 26, 2018

CVSS v3.0
6.5
EPSS
3%
Percentile
87.9
In the wild
Unconfirmed
What it is

An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.03178 · 87.9th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-295 · Improper Certificate Validation
Published
2018-07-26T15:00Z
EPSS history
Timeline
  • 26 JUL 15:00Z
    An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates
    cvelistv5