CVE-2015-8023

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20 CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-80249.3McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC)CVE-2015-80252.1driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate att CVE-2015-80267.8Heap-based buffer overflow in the verify_vbr_checksum function in exfatfsck in exfat-utils before 1.2.1 allows remote attackers to cause a d CVE-2015-80277.5Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, whic CVE-2015-80286.8Multiple buffer overflows in SAP 3D Visual Enterprise Viewer (VEV) allow remote attackers to execute arbitrary code via a crafted (1) 3DM or CVE-2015-80296.8SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted Filmbox document, which triggers memor CVE-2015-80306.8SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D, (2) LWO, (3) JPEG2000, or (4)CVE-2015-80319.8Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.CVE-2015-80325.3In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.CVE-2015-80335.3In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.CVE-2015-80343.3The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive informa CVE-2015-80352.6The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to