CVE-2019-20373

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne…

published January 9, 2020

CVSS
—
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Published
2020-01-09T22:27Z
EPSS history
Timeline
  • 09 JAN 22:27Z
    LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne…
    cvelistv5