6.5

CVE-2024-36472: gnome-shell Origin Validation Error

CVSS: 6.5v3.1MediumDeferred
AliasesMGASA-2024-0314SUSE-SU-2024:2589-1SUSE-SU-2024:2618-1
Published 28-05-2024Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2024-36472 is a medium (CVSS 6.5) Origin Validation Error vulnerability in gnome-shell. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
SUSE-SU-2024:2576-1

Timeline

  1. 28-05-2024
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse6 products
  • gnome-shell&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5< 41.9-150400.3.11.1
  • gnome-shell&distro=SUSE Linux Enterprise Server 12 SP5< 3.20.4-77.28.1
  • gnome-shell&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 3.20.4-77.28.1
  • gnome-shell&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 3.20.4-77.28.1
  • gnome-shell&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 3.20.4-77.28.1
Redhat3 products
  • gnome-shell< 0:3.32.2-56.el8_10 | < 0:40.10-21.el9 | < 0:40.10-19.el9_4
  • gnome-shell-debuginfo< 0:3.32.2-56.el8_10 | < 0:40.10-21.el9 | < 0:40.10-19.el9_4
  • gnome-shell-debugsource< 0:3.32.2-56.el8_10 | < 0:40.10-21.el9 | < 0:40.10-19.el9_4
Opensuse2 products
  • gnome-shell&distro=openSUSE Leap 15.5< 41.9-150400.3.11.1
  • gnome-shell&distro=openSUSE Tumbleweed< 46.3.1-2.1
Debian1 product
  • gnome-shellAll versions (No fix recorded) | < 47.0-3
Mageia1 product
  • gnome-shell< 44.2-1.2.mga9
Ubuntu1 product
  • gnome-shell< 3.36.9-0ubuntu0.20.04.4 | < 42.9-0ubuntu2.2 | < 46.0-0ubuntu6~24.04.3

6 vendors · 14 products

References

29 links
Show all 29 references