CVE-2018-20781

EPSS 1.5%

Vexday Risk Score

18Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit simPatch referenciado

Ciclo de vida

23 may 2018Exploit Metasploit disponible

12 feb 2019Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

Productos afectados

n/a · n/a

Referencias

https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919 https://bugzilla.gnome.org/show_bug.cgi?id=781486 https://github.com/huntergregal/mimipenguin https://github.com/huntergregal/mimipenguin/tree/d95f1e08ce79783794f38433bbf7de5abd9792da https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3 https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2 https://usn.ubuntu.com/3894-1/https://www.oracle.com/security-alerts/cpujan2021.html