What is the CVSS score of CVE-2020-17489?

CVE-2020-17489 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2020-17489?

Yes, a public proof-of-concept exploit is available for CVE-2020-17489. Prioritise patching immediately. EPSS: 0.6%.

Gnome Shell CVE-2020-17489

MEDIUM

Insufficiently Protected Credentials (CWE-522)

2020-08-11 cve@mitre.org

Information Disclosure Gnome Shell Ubuntu Linux Debian Linux Leap

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Aug 11, 2020 - 21:15 nvd

MEDIUM 4.3

DescriptionNVD

An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.)

AnalysisAI

An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.) Affected products include: Gnome Gnome-Shell, Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap. Version information: through 3.36.4..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.