CVE-2019-12887

Critical

KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).

mitre·CWE-294·Published 2019-06-27

CVSS

8.1

EPSS

0.01

KEV

Exploits

cve.orgen

79 chars

KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).

NVDen

79 chars

KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).

OSV.deven

79 chars

KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).

GHSAen

386 chars

LinOTP is prone to a replay attack with activated automatic resynchronization. This vulnerability may allow an attacker to successfully log in with OTP values recorded at a previous point in time. This attack is only possible if automatic resynchronization is enabled for the TOTP token type. The automatic resynchronization is deactivated by default. All other tokens are unaffected.

NVDes

95 chars

KeyIdentity LinOTP anterior a 2.10.5.3 tiene un control de acceso incorrecto (problema 1 de 2).

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
3.0	Primary	NVD	8.1	2.2	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H