PT-2021-9725 · Red Hat+3 · Red Hat Enterprise Linux 8+4
Published
2020-09-08
·
Updated
2023-02-12
·
CVE-2020-14391
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Red Hat Enterprise Linux 8 versions prior to 8.2
Description
A flaw was found in the GNOME Control Center where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.
Recommendations
For Red Hat Enterprise Linux 8 versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the GNOME Settings User Interface to minimize the risk of exploitation. Avoid using the Red Hat Customer Portal credentials in the affected interface until the issue is resolved.
Exploit
Fix
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Red Hat
Red Hat Enterprise Linux 8
Rocky Linux