What is the CVSS score of CVE-2020-28049?

CVE-2020-28049 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2020-28049?

Yes, a public proof-of-concept exploit is available for CVE-2020-28049. Prioritise patching immediately. EPSS: 0.4%.

Sddm CVE-2020-28049

MEDIUM

Race Condition (CWE-362)

2020-11-04 cve@mitre.org

Race Condition Information Disclosure Sddm Leap Debian Linux Fedora

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Nov 04, 2020 - 19:15 nvd

MEDIUM 6.3

DescriptionNVD

An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and, for example, intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation.

AnalysisAI

An issue was discovered in SDDM before 0.19.0. Rated medium severity (CVSS 6.3). Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-362. An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and, for example, intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation. Affected products include: Sddm Project Sddm, Opensuse Leap, Debian Debian Linux, Fedoraproject Fedora. Version information: before 0.19.0..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.