CVE-2026-47273: fallo de gravedad media en mcdope pam_usb
pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB device serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates. This vulnerability is fixed in 0.9.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Productos afectados
mcdope · pam_usbCVEs relacionadas — mcdope pam_usb
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-64669HIGHpam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clientsEPSS 0.4%CVE-2026-64668HIGHpam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clientsEPSS 0.4%CVE-2026-48064HIGHpam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypassEPSS 0.3%CVE-2026-47269HIGHpam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as localEPSS 0.3%CVE-2026-44711HIGHpam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruptionEPSS 0.2%CVE-2026-64666HIGHpam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unsetEPSS 0.2%