CVE-2011-4338
High
Description
Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.
SeverityHigh
CVSS7.8
Exploit probability—
ProductShaman
PublishedFeb 12, 2020
First seenFeb 12, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shaman_project shaman | 1.0.9 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.