CVE-2019-3825: canonical ubuntu_linux Improper Authentication
Vulnerability summary
CVE-2019-3825 is a medium (CVSS 6.9) Improper Authentication vulnerability in canonical ubuntu_linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 06-02-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.4MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated6.4MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST6.4MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.50% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- ubuntu_linuxEOL18.04 | 18.10
Debian1 product
- gdm3< 3.30.2-3
Gnome1 product
- gnome_display_manager< 3.31.4
Redhat1 product
- enterprise_linuxEOL7.0
Suse1 product
- gdm&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 3.26.2.1-13.19.2
The gnome projectr1 product
- gdm3.31.4
Ubuntu1 product
- gdm3All versions (No fix recorded) | < 3.28.3-0ubuntu18.04.4
7 vendors · 7 products
References
14 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825X Refsource CONFIRMExploitIssue TrackingMitigationThird Party Advisory
