What’s Vulnerable › Vulnerabilities

CVE-2011-4338

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-12 · updated 2026-06-16
• Weakness: CWE-287

Description

Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.

Affected products

• shaman: 1.0.9

References

• https://bbs.archlinux.org/viewtopic.php?id=64066&p=1
• https://www.openwall.com/lists/oss-security/2011/11/22/4
• https://bbs.archlinux.org/viewtopic.php?id=64066&p=1
• https://www.openwall.com/lists/oss-security/2011/11/22/4

Get alerted when CVE-2011-4338 or the next vulnerability affects your stack