CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9312
https://notcve.org/view.php?id=CVE-2024-9312
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges. • https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2 https://www.cve.org/CVERecord?id=CVE-2024-9312 • CWE-286: Incorrect User Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9313
https://notcve.org/view.php?id=CVE-2024-9313
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. El módulo PAM de Authd anterior a la versión 0.3.5 puede permitir que los usuarios administrados por el broker se hagan pasar por cualquier otro usuario administrado por el mismo broker y realicen cualquier operación PAM con él, incluida la autenticación como ellos. • https://github.com/ubuntu/authd/security/advisories/GHSA-x5q3-c8rm-w787 https://www.cve.org/CVERecord?id=CVE-2024-9313 •