Home > Vulnerability Database > CVE-2024-47191

Mend.io Vulnerability Database

CVE-2024-47191

Date: October 8, 2024

A vulnerability was found in a PAM module, the oath-toolkit. The module gained a feature that allowed placing the OTP state file, called the usersfile, in the home directory of the to-be-authenticated user. The PAM module performed unsafe file operations in the users' home directories. Since PAM stacks typically run as root, this flaw allows a malicious user to jeopardize an environment.

Severity Score

7.1

Related Resources (20)

Url: http://www.openwall.com/lists/oss-security/2024/10/08/4

Url: http://www.openwall.com/lists/oss-security/2024/10/08/2

Url: http://www.openwall.com/lists/oss-security/2024/10/15/7

Url: https://gitlab.com/oath-toolkit/oath-toolkit/-/issues/43

Url: http://www.openwall.com/lists/oss-security/2024/10/18/2

Url: http://www.openwall.com/lists/oss-security/2024/10/08/1

Url: https://security.opensuse.org/2024/10/04/oath-toolkit-vulnerability.html

Url: http://www.openwall.com/lists/oss-security/2024/10/18/1

Url: http://www.openwall.com/lists/oss-security/2024/10/04/2

Url: http://www.openwall.com/lists/oss-security/2024/10/05/1

Url: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/95ef255e6a401949ce3f67609bf8aac2029db418

Url: http://www.openwall.com/lists/oss-security/2024/10/17/1

Url: https://security-tracker.debian.org/tracker/CVE-2024-47191

Url: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3271139989fde35ab0163b558fc29e80c3a280e5

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-47191

Url: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/60d9902b5c20f27e70f8e9c816bfdc0467567e1a

Url: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3235a52f6b87cd1c5da6508f421ac261f5e33a70

Url: https://www.openwall.com/lists/oss-security/2024/10/04/2

Url: https://www.nongnu.org/oath-toolkit/security/CVE-2024-47191

Url: https://www.mend.io/vulnerability-database/CVE-2024-47191

Severity Score

7.1

Weakness Type (CWE)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22

CVSS v3.1

Base Score:	7.1
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2024-47191

Date: October 8, 2024

Severity Score

Related Resources (20)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?