CVE-2019-3820: canonical ubuntu_linux Improper Authorization

CVSS: 4.8v3.0MediumModified

AliasesSUSE-SU-2019:1390-1SUSE-SU-2019:1459-1RHSA-2020:1021+4 more

Published 06-02-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-3820 is a medium (CVSS 4.8) Improper Authorization vulnerability in canonical ubuntu_linux. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

29/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.8/10

010

Medium · v3.0 (CVE.org)

EPSS score

0.50%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 2

OPENSUSE-SU-2024:10797-1 RHSA-2019:3553 USN-7052-1

Timeline

06-02-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.

CVSS metrics

8 scores · 5 sources · 3 versions

v3.14.3v3.04.8v2.04.6

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

0.00 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat92 products

accountsservice< 0:0.6.50-7.el7
accountsservice-debuginfo< 0:0.6.50-7.el7
accountsservice-devel< 0:0.6.50-7.el7
accountsservice-libs< 0:0.6.50-7.el7
colord< 0:1.3.4-2.el7

colord-debuginfo< 0:1.3.4-2.el7
colord-devel< 0:1.3.4-2.el7
colord-devel-docs< 0:1.3.4-2.el7
colord-extra-profiles< 0:1.3.4-2.el7
colord-libs< 0:1.3.4-2.el7
control-center< 1:3.28.1-6.el7
control-center-debuginfo< 1:3.28.1-6.el7
control-center-filesystem< 1:3.28.1-6.el7
gdm< 1:3.28.2-22.el7
gdm-debuginfo< 1:3.28.2-22.el7
gdm-devel< 1:3.28.2-22.el7
gdm-pam-extensions-devel< 1:3.28.2-22.el7
gnome-classic-session< 0:3.28.1-11.el7
gnome-online-accounts< 0:3.28.2-1.el7
gnome-online-accounts-debuginfo< 0:3.28.2-1.el7
gnome-online-accounts-devel< 0:3.28.2-1.el7
gnome-settings-daemon< 0:3.28.1-8.el7
gnome-settings-daemon-debuginfo< 0:3.28.1-8.el7
gnome-settings-daemon-devel< 0:3.28.1-8.el7
gnome-shell< 0:3.28.3-24.el7
gnome-shell-debuginfo< 0:3.28.3-24.el7
gnome-shell-extension-alternate-tab< 0:3.28.1-11.el7
gnome-shell-extension-apps-menu< 0:3.28.1-11.el7
gnome-shell-extension-auto-move-windows< 0:3.28.1-11.el7
gnome-shell-extension-common< 0:3.28.1-11.el7
gnome-shell-extension-dash-to-dock< 0:3.28.1-11.el7
gnome-shell-extension-disable-screenshield< 0:3.28.1-11.el7
gnome-shell-extension-drive-menu< 0:3.28.1-11.el7
gnome-shell-extension-extra-osk-keys< 0:3.28.1-11.el7
gnome-shell-extension-horizontal-workspaces< 0:3.28.1-11.el7
gnome-shell-extension-launch-new-instance< 0:3.28.1-11.el7
gnome-shell-extension-native-window-placement< 0:3.28.1-11.el7
gnome-shell-extension-no-hot-corner< 0:3.28.1-11.el7
gnome-shell-extension-panel-favorites< 0:3.28.1-11.el7
gnome-shell-extension-places-menu< 0:3.28.1-11.el7
gnome-shell-extension-screenshot-window-sizer< 0:3.28.1-11.el7
gnome-shell-extension-systemMonitor< 0:3.28.1-11.el7
gnome-shell-extension-top-icons< 0:3.28.1-11.el7
gnome-shell-extension-updates-dialog< 0:3.28.1-11.el7
gnome-shell-extension-user-theme< 0:3.28.1-11.el7
gnome-shell-extension-window-grouper< 0:3.28.1-11.el7
gnome-shell-extension-window-list< 0:3.28.1-11.el7
gnome-shell-extension-windowsNavigator< 0:3.28.1-11.el7
gnome-shell-extension-workspace-indicator< 0:3.28.1-11.el7
gnome-shell-extensions< 0:3.28.1-11.el7
gnome-tweak-tool< 0:3.28.1-7.el7
gsettings-desktop-schemas< 0:3.28.0-3.el7
gsettings-desktop-schemas-devel< 0:3.28.0-3.el7
gtk-update-icon-cache< 0:3.22.30-5.el7
gtk3< 0:3.22.30-5.el7
gtk3-debuginfo< 0:3.22.30-5.el7
gtk3-devel< 0:3.22.30-5.el7
gtk3-devel-docs< 0:3.22.30-5.el7
gtk3-immodule-xim< 0:3.22.30-5.el7
gtk3-immodules< 0:3.22.30-5.el7
gtk3-tests< 0:3.22.30-5.el7
libcanberra< 0:0.30-9.el7
libcanberra-debuginfo< 0:0.30-9.el7
libcanberra-devel< 0:0.30-9.el7
libcanberra-gtk2< 0:0.30-9.el7
libcanberra-gtk3< 0:0.30-9.el7
libgweather< 0:3.28.2-3.el7
libgweather-debuginfo< 0:3.28.2-3.el7
libgweather-devel< 0:3.28.2-3.el7
LibRaw< 0:0.19.4-1.el7
LibRaw-debuginfo< 0:0.19.4-1.el7
LibRaw-devel< 0:0.19.4-1.el7
LibRaw-static< 0:0.19.4-1.el7
mutter< 0:3.28.3-20.el7
mutter-debuginfo< 0:3.28.3-20.el7
mutter-devel< 0:3.28.3-20.el7
nautilus< 0:3.26.3.1-7.el7
nautilus-debuginfo< 0:3.26.3.1-7.el7
nautilus-devel< 0:3.26.3.1-7.el7
nautilus-extensions< 0:3.26.3.1-7.el7
osinfo-db< 0:20190805-2.el7
shared-mime-info< 0:1.8-5.el7
shared-mime-info-debuginfo< 0:1.8-5.el7
tracker< 0:1.10.5-8.el7
tracker-debuginfo< 0:1.10.5-8.el7
tracker-devel< 0:1.10.5-8.el7
tracker-docs< 0:1.10.5-8.el7
tracker-needle< 0:1.10.5-8.el7
tracker-preferences< 0:1.10.5-8.el7
xchat< 1:2.8.8-25.el7
xchat-debuginfo< 1:2.8.8-25.el7
xchat-tcl< 1:2.8.8-25.el7

Show all 92

Suse14 products

gnome-shell&distro=SUSE Linux Enterprise Desktop 12 SP3< 3.20.4-77.23.1
gnome-shell&distro=SUSE Linux Enterprise Desktop 12 SP4< 3.20.4-77.23.1
gnome-shell&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 3.26.2+20180130.0d9c74212-4.19.2
gnome-shell&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 3.26.2+20180130.0d9c74212-4.19.2
gnome-shell&distro=SUSE Linux Enterprise Server 12 SP3< 3.20.4-77.23.1

Show all 14

Opensuse3 products

leapEOL15.0 | 15.1 | 42.3
gnome-shell&distro=openSUSE Leap 15.0< 3.26.2+20180130.0d9c74212-lp151.7.3.1
gnome-shell&distro=openSUSE Leap 15.1< 3.26.2+20180130.0d9c74212-lp151.7.3.1

Canonical1 product

ubuntu_linuxEOL18.04 | 18.10

Debian1 product

gnome-shell< 3.30.2-3

Gnome1 product

gnome-shell≥ 3.15.91, < 3.30.3 | ≥ 3.31.0, < 3.31.5

The gnome project1 product

gnome-shellsince 3.15.91

Ubuntu1 product

gnome-shell< 3.18.5-0ubuntu0.3+esm1 | < 3.28.3+git20190124-0ubuntu18.04.2

8 vendors · 114 products

References

64 links

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820X Refsource CONFIRMExploitIssue TrackingThird Party Advisory
gitlab.gnome.org/GNOME/gnome-shell/issues/851X Refsource MISCARTICLEIssue TrackingPatchThird Party Advisory
usn.ubuntu.com/3966-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00023.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-06/msg00049.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.suse.com/support/update/announcement/2019/suse-su-20191390-1/Advisory
bugzilla.suse.com/1124493REPORT
www.suse.com/security/cve/CVE-2019-3820WEB
bugzilla.suse.com/SLE-6660REPORT
www.suse.com/support/update/announcement/2019/suse-su-20191459-1/Advisory

Show all 64 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities