CVE-2012-6140

2013-04-2410:28:37

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.007

Percentile

81.2%

JSON

pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.

Affected configurations

Nvd

Node

googleauthenticatorRange≤0.91

googleauthenticatorMatch0.86

googleauthenticatorMatch0.87

VendorProductVersionCPE
googleauthenticator*cpe:2.3:a:google:authenticator:*:*:*:*:*:*:*:*
googleauthenticator0.86cpe:2.3:a:google:authenticator:0.86:*:*:*:*:*:*:*
googleauthenticator0.87cpe:2.3:a:google:authenticator:0.87:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	authenticator	*	cpe:2.3:a:google:authenticator::::::::
google	authenticator	0.86	cpe:2.3:a:google:authenticator:0.86:::::::*
google	authenticator	0.87	cpe:2.3:a:google:authenticator:0.87:::::::*