CVE-2020-13881

Description

In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

1.239

Vulnerability	OS Platform
PAM module for using TACACS+ as an authentication service (USN-4521-1) libpam-tacplus_1.3.8-2+deb8u1build0.16.04.1_i386.deb	Linux
PAM module for using TACACS+ as an authentication service (USN-4521-1) libpam-tacplus_1.3.8-2+deb8u1build0.16.04.1_amd64.deb	Linux
PAM module for using TACACS+ as an authentication service (USN-4521-1) libpam-tacplus_1.3.8-2+deb8u1build0.18.04.1_i386.deb	Linux
PAM module for using TACACS+ as an authentication service (USN-4521-1) libpam-tacplus_1.3.8-2+deb8u1build0.18.04.1_amd64.deb	Linux
PAM module for using TACACS+ as an authentication service (USN-4521-1) libpam-tacplus_1.3.8-2+deb8u1build0.20.04.1_amd64.deb	Linux
Insertion of Sensitive Information into Log File Vulnerability (CVE-2020-13881)	NCM

No records found