CVE-2023-49347

Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347	Third Party Advisory
https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj	Third Party Advisory
https://ubuntu.com/security/notices/USN-6556-1	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ubuntubudgie:budgie_extras:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-12-14 22:15

Updated : 2023-12-20 20:41

NVD link : CVE-2023-49347

Mitre link : CVE-2023-49347

CVE.ORG link : CVE-2023-49347

JSON object : View

Products Affected

ubuntubudgie

budgie_extras

CWE

CWE-668

Exposure of Resource to Wrong Sphere

CWE-377

Insecure Temporary File

{"id": "CVE-2023-49347", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "published": "2023-12-14T22:15:43.787", "references": [{"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://ubuntu.com/security/notices/USN-6556-1", "tags": ["Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-377"}, {"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application."}, {"lang": "es", "value": "Los datos temporales pasados entre los componentes de la aplicaci\u00f3n mediante Budgie Extras Windows Previews podr\u00edan verse o manipularse. Los datos se almacenan en una ubicaci\u00f3n a la que puede acceder cualquier usuario que tenga acceso local al sistema. Los atacantes pueden leer informaci\u00f3n privada de Windows, presentar informaci\u00f3n falsa a los usuarios o negar el acceso a la aplicaci\u00f3n."}], "lastModified": "2023-12-20T20:41:11.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ubuntubudgie:budgie_extras:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8486FB0D-3D4A-437C-94B7-605883A1D427", "versionEndExcluding": "1.7.1", "versionStartIncluding": "1.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}