CVE Vulnerabilities

CVE-2023-45866

Improper Authentication

Published: Dec 08, 2023 | Modified: Dec 12, 2024
CVSS 3.x
6.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.x
RedHat/V2
RedHat/V3
6.3 MODERATE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Ubuntu
MEDIUM

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Android Google 4.2.2 (including) 4.2.2 (including)
Red Hat Enterprise Linux 8 RedHat bluez-0:5.63-3.el8_10 *
Red Hat Enterprise Linux 8 RedHat bluez-0:5.63-3.el8_10 *
Red Hat Enterprise Linux 9 RedHat bluez-0:5.72-2.el9 *
Red Hat Enterprise Linux 9 RedHat bluez-0:5.72-2.el9 *
Bluez Ubuntu bionic *
Bluez Ubuntu devel *
Bluez Ubuntu esm-infra/bionic *
Bluez Ubuntu esm-infra/xenial *
Bluez Ubuntu focal *
Bluez Ubuntu jammy *
Bluez Ubuntu lunar *
Bluez Ubuntu mantic *
Bluez Ubuntu noble *
Bluez Ubuntu trusty *
Bluez Ubuntu xenial *

Potential Mitigations

References