suddoers configuration for cscreen not restrictive enough
CVE-2022-21946

5.3MEDIUM

Key Information:

Vendor

Opensuse
Status
Factory
Vendor
CVE Published:
16 March 2022

What is CVE-2022-21946?

A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.

Affected Version(s)

Factory cscreen <= 1.2-1.3

References

https://bugzilla.suse.com/show_bug.cgi?id=1196451

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner of SUSE
.