Unscored CVE-2012-4741 EUVD-2012-4666GHSA-r267-cj3p-f63m

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assi…

Published Aug 31, 2012 · Updated Aug 6, 2024 · Assigned by mitre

Description

The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assignment extensions, which allows remote attackers to spoof user identities via the User-Name RADIUS attribute.

References

[Packetfence-announce] 20120413 PacketFence 3.3.0 released! mailing-list
packetfence-radius-spoofing(78868) vdb-entry
http://www.packetfence.org/bugs/view.php?id=1390