CVE-2023-49347 - Vulnerability Details - OpenCVE

Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00055.

Key SSVC decision points have not yet been added.

Vendors	Products
Ubuntubudgie	Budgie Extras

Configuration 1 [-]

cpe:2.3:a:ubuntubudgie:budgie_extras:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-53330	Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.
Ubuntu USN	USN-6556-1	Budgie Extras vulnerabilities

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347
https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj
https://ubuntu.com/security/notices/USN-6556-1

History

No history.

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2023-12-14T21:31:32.489Z

Updated: 2024-08-02T21:53:45.426Z

Reserved: 2023-11-27T03:17:52.866Z

Link: CVE-2023-49347

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-14T22:15:43.787

Modified: 2024-11-21T08:33:17.063

Link: CVE-2023-49347

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49347", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2023-11-27T03:17:52.866Z", "datePublished": "2023-12-14T21:31:32.489Z", "dateUpdated": "2024-08-02T21:53:45.426Z"}, "containers": {"cna": {"affected": [{"vendor": "Ubuntu Budgie", "product": "Budgie Extras", "platforms": ["Linux"], "packageName": "budgie-extras", "versions": [{"status": "affected", "version": "v1.4.0", "lessThan": "v1.7.1", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application."}], "datePublic": "2023-12-14T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-668", "description": "CWE-668", "lang": "en", "type": "CWE"}, {"cweId": "CWE-377", "description": "CWE-377", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["third-party-advisory"], "url": "https://ubuntu.com/security/notices/USN-6556-1"}, {"tags": ["issue-tracking"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347"}, {"tags": ["issue-tracking"], "url": "https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj"}], "credits": [{"lang": "en", "type": "finder", "value": "Matthias Gerstner"}, {"lang": "en", "type": "analyst", "value": "Sam Lane"}, {"lang": "en", "type": "remediation verifier", "value": "David Mohammed"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "baseScore": 6, "baseSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-12-14T21:31:32.489Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:53:45.426Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://ubuntu.com/security/notices/USN-6556-1"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ubuntubudgie:budgie_extras:*:*:*:*:*:*:*:*", "matchCriteriaId": "8486FB0D-3D4A-437C-94B7-605883A1D427", "versionEndExcluding": "1.7.1", "versionStartIncluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application."}, {"lang": "es", "value": "Los datos temporales pasados entre los componentes de la aplicaci\u00f3n mediante Budgie Extras Windows Previews podr\u00edan verse o manipularse. Los datos se almacenan en una ubicaci\u00f3n a la que puede acceder cualquier usuario que tenga acceso local al sistema. Los atacantes pueden leer informaci\u00f3n privada de Windows, presentar informaci\u00f3n falsa a los usuarios o negar el acceso a la aplicaci\u00f3n."}], "id": "CVE-2023-49347", "lastModified": "2024-11-21T08:33:17.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "security@ubuntu.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-14T22:15:43.787", "references": [{"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347"}, {"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "https://ubuntu.com/security/notices/USN-6556-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49347"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-xxfq-fqfp-cpvj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://ubuntu.com/security/notices/USN-6556-1"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-377"}, {"lang": "en", "value": "CWE-668"}], "source": "security@ubuntu.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-668"}], "source": "nvd@nist.gov", "type": "Primary"}]}