CVE-2025-8941 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 16%

Debian Releases

Debian Product

Codename

pam

bookworm	undetermined
bullseye	undetermined
bullseye (security)	undetermined
forky	undetermined
sid	undetermined
trixie	undetermined

Red Hat Enterprise Linux Releases

Red Hat Product

Release

pam

RHEL 8	0:1.3.1-38.el8_10 fixed
RHEL 8.2 AUS	0:1.3.1-8.el8_2.2 fixed
RHEL 8.4 AUS	0:1.3.1-14.el8_4.2 fixed
RHEL 8.6 AUS	0:1.3.1-16.el8_6.3 fixed
RHEL 8.6 E4S	0:1.3.1-16.el8_6.3 fixed
RHEL 8.6 TUS	0:1.3.1-16.el8_6.3 fixed
RHEL 8.8 E4S	0:1.3.1-26.el8_8.2 fixed
RHEL 8.8 TUS	0:1.3.1-26.el8_8.2 fixed
RHEL 9	0:1.5.1-26.el9_6 fixed

pam-devel

RHEL 8	0:1.3.1-38.el8_10 fixed
RHEL 8.2 AUS	0:1.3.1-8.el8_2.2 fixed
RHEL 8.4 AUS	0:1.3.1-14.el8_4.2 fixed
RHEL 8.6 AUS	0:1.3.1-16.el8_6.3 fixed
RHEL 8.6 E4S	0:1.3.1-16.el8_6.3 fixed
RHEL 8.6 TUS	0:1.3.1-16.el8_6.3 fixed
RHEL 8.8 E4S	0:1.3.1-26.el8_8.2 fixed
RHEL 8.8 TUS	0:1.3.1-26.el8_8.2 fixed
RHEL 9	0:1.5.1-26.el9_6 fixed

pam-docs

RHEL 9

0:1.5.1-26.el9_6

fixed

Amazon Linux Releases

Amazon Package

Release

pam

Amazon Linux 2	0:1.1.8-23.amzn2.0.5 fixed
Amazon Linux 2023	0:1.5.1-8.amzn2023.0.7 fixed

pam-debuginfo

Amazon Linux 2	0:1.1.8-23.amzn2.0.5 fixed
Amazon Linux 2023	0:1.5.1-8.amzn2023.0.7 fixed

pam-debugsource

Amazon Linux 2023

0:1.5.1-8.amzn2023.0.7

fixed

pam-devel

Amazon Linux 2	0:1.1.8-23.amzn2.0.5 fixed
Amazon Linux 2023	0:1.5.1-8.amzn2023.0.7 fixed

pam-docs

Amazon Linux 2023

0:1.5.1-8.amzn2023.0.7

fixed

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://access.redhat.com/errata/RHSA-2025:14557

https://access.redhat.com/errata/RHSA-2025:15099

https://access.redhat.com/errata/RHSA-2025:15100

https://access.redhat.com/errata/RHSA-2025:15101

https://access.redhat.com/errata/RHSA-2025:15102

https://access.redhat.com/errata/RHSA-2025:15103

https://access.redhat.com/errata/RHSA-2025:15104

https://access.redhat.com/errata/RHSA-2025:15105

https://access.redhat.com/errata/RHSA-2025:15106

https://access.redhat.com/errata/RHSA-2025:15107

https://access.redhat.com/errata/RHSA-2025:15709

https://access.redhat.com/errata/RHSA-2025:15827

https://access.redhat.com/errata/RHSA-2025:15828

https://access.redhat.com/errata/RHSA-2025:16524

https://access.redhat.com/errata/RHSA-2025:17181

https://access.redhat.com/errata/RHSA-2025:18219

https://access.redhat.com/errata/RHSA-2025:21885

https://access.redhat.com/security/cve/CVE-2025-8941

https://bugzilla.redhat.com/show_bug.cgi?id=2388220