CVE-2013-7292

Published: Jan 13, 2014Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

VASCO IDENTIKEY Authentication Server (IAS) 3.4.x allows remote authenticated users to bypass Active Directory (AD) authentication by entering only a DIGIPASS one-time password, instead of the intended combination of this one-time password and a multiple-time AD password.

Affected (1)

Products: Vasco: Identikey Authentication Server

1 product

Identikey Authentication Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vasco Identikey Authentication Server	Version 3.4

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

http://www.kb.cert.org/vuls/id/612076

Source: cve@mitre.org

US Government Resource

http://www.kb.cert.org/vuls/id/612076

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.