PT-2022-15196 · Opensuse · Screen

Matthias Gerstner · Published 2022-03-16 · Updated 2024-06-15 · CVE-2022-21946

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions openSUSE Factory cscreen versions 1.2-1.3 and prior versions.

Description A vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen session.

Recommendations For openSUSE Factory cscreen versions 1.2-1.3 and prior versions, update to a version that fixes the sudoers configuration issue to prevent local users from gaining unauthorized privileges. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-21946

OPENSUSE-SU-2024:11924-1

Affected Products

Screen

References · 8

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1196451 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-21946 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21946 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11924-1 · Vendor Advisory
• https://t.me/cibsecurity/39016 · Telegram Post
• https://suse.com/security/cve/CVE-2022-21946 · Note
• https://t.me/cvenotify/42281 · Telegram Post
• https://suse.com/security/cve/CVE-2022-21945 · Note