CVE-2024-5148

{"id": "CVE-2024-5148", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-09-02T12:15:19.910", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-5148", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282003", "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-488"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el paquete gnome-remote-desktop. El daemon del sistema gnome-remote-desktop realiza una validaci\u00f3n inadecuada de los agentes de sesi\u00f3n mediante m\u00e9todos D-Bus relacionados con la transici\u00f3n de una conexi\u00f3n de cliente desde la pantalla de inicio de sesi\u00f3n a la sesi\u00f3n de usuario. Como resultado, el certificado y la clave TLS de RDP del sistema pueden quedar expuestos a usuarios no autorizados. Esta falla permite que un usuario malintencionado del sistema tome el control de la conexi\u00f3n del cliente RDP durante la transici\u00f3n de la pantalla de inicio de sesi\u00f3n a la sesi\u00f3n de usuario."}], "lastModified": "2024-09-03T12:59:02.453", "sourceIdentifier": "secalert@redhat.com"}