CVE-2019-3811CWE-200CWE-552

A vulnerability was found in sssd

Medium · published January 15, 2019

CVSS v3.0
4.1
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.

The record
Technical detail
CVSS v3.0
4.1 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00696 · 52.5th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-552 · Files or Directories Accessible to External Parties
Published
2019-01-15T15:00Z
EPSS history
Timeline
  • 15 JAN 15:00Z
    A vulnerability was found in sssd
    cvelistv5