CVE-2020-27780 - AskarLabs CVE Database

CVE-2020-27780

Vendor N/A

Product pam

Weakness CWE-287 · Improper authentication

Published December 17, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate.

Key dates

02Disclosure timeline

December 17, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-27780 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2022-42488 Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services. CVE-2025-22375 Authentication Bypass in CyberAudit-Web CVE-2025-55169 WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file' CVE-2023-5326 SATO CL4NX-J Plus WebConfig improper authentication CVE-2026-44547 ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2