CVE Vulnerabilities

CVE-2019-20373

Published: Jan 09, 2020 | Modified: Jan 24, 2020
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the users shell lacks support for Bourne shell syntax. This is related to a run-x-session script.

Affected Software

Name Vendor Start Version End Version
Debian_linux Debian 8.0 (including) 8.0 (including)
Debian_linux Debian 9.0 (including) 9.0 (including)
Debian_linux Debian 10.0 (including) 10.0 (including)
Ldm Ubuntu bionic *
Ldm Ubuntu disco *
Ldm Ubuntu eoan *
Ldm Ubuntu focal *
Ldm Ubuntu groovy *
Ldm Ubuntu trusty *
Ldm Ubuntu xenial *

References