CVE-2024-10394CWE-305

Theft of credentials in Unix client PAGs

High · published November 14, 2024

CVSS v4.0
8.4
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00202 · 9.6th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2024-11-14T19:07Z
EPSS history
Timeline
  • 14 NOV 19:07Z
    Theft of credentials in Unix client PAGs
    cvelistv5