PT-2023-5399 · Xfce+1 · Xfce+1
Matthias Gerstner
·
Published
2023-08-14
·
Updated
2023-09-22
·
CVE-2023-32184
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
opensuse-welcome versions 0.1 through 0.1.9+git.35.4b9444a
Description
A local attacker can execute code as the user that runs opensuse-welcome if a custom layout is chosen, due to an Insecure Storage of Sensitive Information vulnerability. This issue is related to the handling of temporary files when selecting a custom layout, specifically for the Xfce graphical environment.
Recommendations
For opensuse-welcome versions 0.1 through 0.1.9+git.35.4b9444a, update to a version newer than 0.1.9+git.35.4b9444a to resolve the issue. As a temporary workaround, consider avoiding the selection of custom layouts, especially for the Xfce graphical environment, until a patch is available. Restrict access to the opensuse-welcome application to minimize the risk of exploitation.
Exploit
Fix
Insecure Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xfce
Opensuse-Welcome