CVE-2011-3172
unix2_chkpwd do not check for a valid account
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
unix2_chkpwd do not check for a valid account
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
- Record
CVE-2011-3172- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
EUVDEUVD-2011-3139
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
- Record
EUVD-2011-3139- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jv5w-jhcc-wx4g
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts...
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
- Record
GHSA-jv5w-jhcc-wx4g- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
- Record
CVE-2011-3172- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-304, CWE-264
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10043-1 No score
pam-modules-12.1-27.4 on GA media
These are all security issues fixed in the pam-modules-12.1-27.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10043-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:1760-1 No score
Security update for pam-modules
This update for pam-modules fixes the following security issue:
- CVE-2011-3172: Ensure that unix2_chkpwd calls pam_acct_mgmt to prevent usage of locked accounts (bsc#707645).
- Record
SUSE-SU-2018:1760-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pam-modulesSUSE:Linux Enterprise Server 11 SP4 |
before 11-1.27.3.1 | 11-1.27.3.1 |
pam-modulesSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 11-1.27.3.1 | 11-1.27.3.1 |
pam-modulesopenSUSE:Tumbleweed |
before 12.1-27.4 | 12.1-27.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3172 is a medium vulnerability (CVSS 5.4) in Suse Linux Enterprise, published June 8, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in pam-modules 11-1.27.3.1.