Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-3825

A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.

Published

2019-02-06T20:29:00.447

Last Modified

2024-11-21T04:42:37.413

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.3 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.4

Impact Score

10.0

Weaknesses

Type: Secondary
CWE-287
Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gnome	gnome_display_manager	< 3.31.4	Yes
Operating System	canonical	ubuntu_linux	18.04	Yes
Operating System	canonical	ubuntu_linux	18.10	Yes
Operating System	redhat	enterprise_linux	7.0	Yes

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825 Exploit, Issue Tracking, Mitigation, Third Party Advisory ([email protected])
https://usn.ubuntu.com/3892-1/ Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825 Exploit, Issue Tracking, Mitigation, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/3892-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)