Swhkd
CVE-2022-27817
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Lifecycle Timeline
1DescriptionNVD
SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.
AnalysisAI
SWHKD 1.1.5 consumes the keyboard events of unintended users. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Exposure of Resource to Wrong Sphere (CWE-668), which allows attackers to access resources from an unintended security context. SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality. Affected products include: Waycrate Swhkd.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement proper access controls, validate resource access permissions, use security boundaries.
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. Rated high severity (CVSS 7.8), this vulnerability is low attack
SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. Rated high severity (CVSS 7.1), this vulnerability is low attack
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. Rated critical severity (CVSS 9.1), this vulnerability is remote
SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. Rated low severity (CVSS 3.3), this vulnerability i
SWHKD 1.1.5 allows unsafe parsing via the -c option. Rated medium severity (CVSS 5.3), this vulnerability is no authenti
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today