CVE-2012-3462

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
sssd	sssd	1.9.0

References

https://access.redhat.com/security/cve/cve-2012-3462Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3462Exploit, Issue Tracking, Patch
https://pagure.io/SSSD/sssd/issue/1470Exploit, Issue Tracking, Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-3462Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-3462Exploit, Issue Tracking, Patch
https://pagure.io/SSSD/sssd/issue/1470Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 26, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-34634.3Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x CVE-2012-34644.3Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17 CVE-2012-34654.3Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails CVE-2012-34664.4GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a p CVE-2012-34675.0Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which al CVE-2012-34687.5Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vect CVE-2012-34697.5Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vect CVE-2012-34707.5Multiple SQL injection vulnerabilities in application/libraries/api/MY_Countries_Api_Object.php in the Ushahidi Platform before 2.5 allow re CVE-2012-34717.5Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controller CVE-2012-34726.4The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, whic CVE-2012-34736.4The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, wh CVE-2012-34745.0The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obta