CVE-2018-1343

Vulnerability

NetIQ Privileged Account Manager (PAM) versions prior to 3.1.0.4 and 3.2.0.6 contain an exposure that allows unauthenticated access to the remote host. The vulnerability exists in the PAM service, enabling direct access without proper authentication checks. [3]

Exploitation

An attacker can exploit this vulnerability by sending network requests to the affected PAM server without any prior authentication. No user interaction or special privileges are required. The exact attack vector is not detailed in the available references, but the exposure allows direct access to the system. [3]

Impact

Successful exploitation grants an unauthenticated attacker access to the remote host running PAM. This could lead to full compromise of the Privileged Account Manager, potentially exposing managed privileged accounts and credentials. [3]

Mitigation

The vulnerability is fixed in PAM 3.1.0.4 and later for the 3.1.x branch, and in PAM 3.2.0.6 and later for the 3.2.x branch. Users running earlier versions should upgrade immediately. No workaround is provided. [3]