| Package | Affected versions | Patched versions |
|---|---|---|
| org.kohsuke:libpam4j | < 1.10 | 1.10 |
| libpam4j | ≤ 1.8 |
It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free