Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-4523

radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.

Published

2012-11-20T00:55:01.117

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application uninett radsecproxy ≤ 1.6 Yes
Application uninett radsecproxy 1.0 Yes
Application uninett radsecproxy 1.0 Yes
Application uninett radsecproxy 1.0 Yes
Application uninett radsecproxy 1.0 Yes
Application uninett radsecproxy 1.1 Yes
Application uninett radsecproxy 1.1 Yes
Application uninett radsecproxy 1.1 Yes
Application uninett radsecproxy 1.2 Yes
Application uninett radsecproxy 1.3 Yes
Application uninett radsecproxy 1.3 Yes
Application uninett radsecproxy 1.3.1 Yes
Application uninett radsecproxy 1.4 Yes
Application uninett radsecproxy 1.4.1 Yes
Application uninett radsecproxy 1.4.2 Yes
Application uninett radsecproxy 1.4.3 Yes
Application uninett radsecproxy 1.5 Yes
References