CVE-2019-3811

Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 15 Jan 2019, 15:00
Last modified:13 Feb 2025, 16:27

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.2 MEDIUM
v3.1 (nvd)
EPSS Score
0.53% LOW
1% probability +0.37%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Jan 2019, 15:00
Published
Vulnerability first disclosed
13 Feb 2025, 16:27
Last Modified
Vulnerability information updated

Description

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.2CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
  • v3.0•MEDIUM•Score: 4.1CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
  • v2.0•LOW•Score: 2.7AV:A/AC:L/Au:S/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.53%• Percentile: 67%

Techniques & Countermeasures

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

  • CWE-552•Files or Directories Accessible to External Parties

    The product makes files or directories accessible to unauthorized actors, even though they should not be.

Affected Systems

  • debian•debian_linux

    8.0

  • fedoraproject•fedora

    na

  • fedoraproject•sssd

    < 2.1

  • opensuse•leap

    15.0 | 42.3

  • redhat•enterprise_linux

    7.0

  • the sssd project•sssd

    2.1

References (7)