apport vulnerability

2023-04-1322:18:37

Google

osv.dev

apport-cli

privilege escalation

vulnerability

local attacker

sudo less

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Chen Lu, Lei Wang, and YiQi Sun discovered a privilege escalation
vulnerability in apport-cli when viewing crash reports and unprivileged
users are allowed to run sudo less. A local attacker on a specially
configured system could use this to escalate their privilege.