CVE-2010-2940

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-08-30 · updated 2026-06-16
Weakness: CWE-287

Description

The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.

Affected products

[UNKNOWN] sssd: 1.3.0

References

http://secunia.com/advisories/41159
https://bugzilla.redhat.com/show_bug.cgi?id=625189
https://exchange.xforce.ibmcloud.com/vulnerabilities/61399
http://secunia.com/advisories/41159
https://bugzilla.redhat.com/show_bug.cgi?id=625189
https://exchange.xforce.ibmcloud.com/vulnerabilities/61399

Get alerted when CVE-2010-2940 or the next vulnerability affects your stack