CVE-2020-13881: Arista Cloudvision Portal

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.

Affected products

• Arista Cloudvision Portal: before 2020.1.2 (fixed in 2020.1.2)
• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Pam Tacplus Project Pam Tacplus: from 1.3.8, up to and including 1.5.1

Published 2020-06-06. Last modified 2026-06-17.