CVE-2022-21946

Опубликовано: 16 мар. 2022

Источник: nvd

CVSS3: 5.3

CVSS2: 4.6

EPSS Низкий

Описание

A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.

Ссылки

https://bugzilla.suse.com/show_bug.cgi?id=1196451
Exploit
Issue Tracking
Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1196451
Exploit
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:opensuse:cscreen:*:*:*:*:*:*:*:*

Версия от 1.2 (включая) до 1.3 (включая)

cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:*

EPSS

Процентиль: 11%

0.00037

Низкий

5.3 Medium

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-732

Связанные уязвимости

GHSA-wj8w-cmvq-mfv8

CVSS3: 7.8

github

почти 4 года назад

A Improper Privilege Management vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.