CVE-2018-16883CWE-200

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter

Low · published December 19, 2018

CVSS v3.0
2.5
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers.

The record
Technical detail
CVSS v3.0
2.5 · LOW
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00385 · 31.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2018-12-19T14:00Z
EPSS history
Timeline
  • 19 DEC 14:00Z
    sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter
    cvelistv5