CVE-2024-38495

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

No affected versions have been published.

Timeline

Published
Jul 15, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-384965.1The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.CVE-2024-384998.8CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admiCVE-2024-38505.4Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on CVE-2024-385016.1An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-priCVE-2024-385027.1An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-385035.4When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential explCVE-2024-385045.3In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesCVE-2024-385057.5In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteCVE-2024-385068.1In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsCVE-2024-385075.4In JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleCVE-2024-385087.2A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an aCVE-2024-385097.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute ar
CVE-2024-38495: Medium severity, CVSS 5.3 | Vulnix