CVE-2015-8023
Estado: ModificadaMedia (5)—
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
- Puntuación base: 5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.58%
- Percentil entre todas las CVEs puntuadas: 85
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-20, CWE-264
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html
- http://www.debian.org/security/2015/dsa-3398
- http://www.securityfocus.com/bid/84947
- http://www.ubuntu.com/usn/USN-2811-1
- https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html
- http://www.debian.org/security/2015/dsa-3398
- http://www.securityfocus.com/bid/84947
- http://www.ubuntu.com/usn/USN-2811-1
- https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2015-8023",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2015-11-18T16:59:07.587",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2015/dsa-3398",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/84947",
"source": "cve@mitre.org"
},
{
"url": "http://www.ubuntu.com/usn/USN-2811-1",
"source": "cve@mitre.org"
},
{
"url": "https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2015/dsa-3398",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/84947",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ubuntu.com/usn/USN-2811-1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message."
},
{
"lang": "es",
"value": "La implementación del servidor del protocolo EAP-MSCHAPv2 en el plugin eap-mschapv2 en strongSwan 4.2.12 hasta la versión 5.x en versiones anteriores a 5.3.4 no valida adecuadamente el estado local, lo que permite a atacantes remotos eludir la autenticación a través de un mensaje Success vacío en respuesta a un mensaje Challenge inicial."
}
],
"lastModified": "2026-06-17T00:33:53.070",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E88A537F-F4D0-46B9-9E37-965233C2A355"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38209DC9-3BE6-49EF-8BA1-6E2BC5D24FEF"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "155EB8F5-7C3C-4293-91EE-62DA561DA54A"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E42B67A3-8650-426F-A8E8-DCA4180D787A"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "21CDA326-C5E4-4BAF-9DC6-4E5A57304C1F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.2.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7AF119CF-2CC5-4313-8722-06BCE3DC6255"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "384C0CAE-8AC3-47AA-9F1C-9DE6779CA583"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00BC4DA6-BFD1-43CF-B8B8-DACBF09E4721"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FEDBF811-7E48-4E99-AE05-FFC12AAF1CDF"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83086A98-0F54-460E-929F-A32DCCC604A7"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8421916C-B6D2-4771-8E59-7057ACC096E6"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A76F8B29-E036-4895-8296-29FE49C34A34"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "345E6CA4-A6E3-4A8B-9542-04D032956FCB"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA544693-EE26-47A9-9EA2-5CA2AE17E387"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "693623FC-189E-478E-8426-292A9002AABA"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "278AB378-33D0-449D-8578-B537B4D28C5B"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7B465A7-9C74-411B-B65A-892BED6FBD39"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D84EEB7-9900-4765-A1AD-B005618ACEDF"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89057C10-2C55-45CB-8497-40E27EAED297"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D8A9FCA-801F-4320-A3EA-F3EA952F47A6"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7350416E-359D-45F4-A3AC-1CF7E6EC7ED3"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23A022A5-6DDA-4B4C-8354-935F9D99BC74"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73AED6DF-50C7-49DE-A9CA-A5AB519B4832"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3BDCDDFD-E4ED-436F-A8AD-B218CC5790D3"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:4.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1650266B-7975-4ADB-8E7F-A2854ED27CCC"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "944942A8-79D0-40AC-BE98-D552DCF2BB07"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "905ABDB8-6CC3-4F7F-8853-8EDDA5E5AB8F"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14E2A13E-427F-45A7-B898-64C10CD8962B"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40ED1E2A-B769-4B1D-83D1-300789E03C97"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "339D620A-CD60-4078-81A1-5703B1CFBB3D"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0973151D-E7F0-4F3D-B2AD-62486C27DFEE"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A2A1F50-F88A-4601-9DAB-BD47BE0E7750"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CBC48CDA-33DB-42E3-AEC7-431C62055E6E"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F0C952A-B468-4224-B871-D55B5E6D4164"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED1BE2B5-44E6-49C1-B030-58195ACC12CF"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EEBF7AF-DC11-4F1A-BE21-236A39D94106"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "619B246C-CCB8-4EAC-A992-724A9E56E8E6"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2FDA9786-AA47-405A-9E76-4D9B69151D1D"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB32E0A3-A72A-4940-A265-ED4896F6A60D"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C944A53-DF8C-4A86-95D0-A1035571E2FC"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C675D50-A320-487F-BD45-CD4C7F181130"
},
{
"criteria": "cpe:2.3:a:strongswan:strongswan:5.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3BF45828-9EE6-49B0-A038-AC40B2506818"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}