CVE-2017-12197

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863 CWE-20

Affected software

Vendor	Product	Versions
Red Hat, Inc.	libpam4j	up to and including 1.8

References

https://access.redhat.com/errata/RHSA-2017:2904Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2905Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2906Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1503103Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00008.htmlThird Party Advisory
https://www.debian.org/security/2017/dsa-4025Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2904Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2905Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2906Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1503103Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00008.htmlThird Party Advisory
https://www.debian.org/security/2017/dsa-4025Third Party Advisory

Timeline

Published: Jan 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121999.8The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue CVE-2017-12205.3IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. The information can be CVE-2017-122006.1The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.CVE-2017-12219.8IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require that users should have strong passwords by default, which makes it eas CVE-2017-122115.3A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticat CVE-2017-122126.1A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-CVE-2017-122134.3A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches cou CVE-2017-122148.8A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Cus CVE-2017-122157.1A vulnerability in the email message filtering feature of Cisco AsyncOS Software for the Cisco Email Security Appliance could allow an unaut CVE-2017-122168.8A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write CVE-2017-122175.3A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture E CVE-2017-122185.8A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email Se