CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
COMPLETE
AV:N/AC:H/Au:S/C:P/I:P/A:C
EPSS
Percentile
81.9%
The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind
in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and
1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/*
authorization check and obtain administrative access by leveraging access
to a two-component principal with an initial “kadmind” substring, as
demonstrated by a “ka/x” principal.