CVE-2024-36472
Description
A vulnerability was found in GNOME Shell. A portal helper can be launched automatically without user confirmation based on the network responses provided by an adversary.
Statement
Although this vulnerability may be triggered without user interaction required, it needs an attacker to control the local network and perform a man in the middle attack. That would then open a vector of attack through a web portal that could run malicious javascript code, but the attack would still need to chain other vulnerabilities to be able to harm the host, such as memory safety vulnerabilities and web process sandbox escaping. Hence this issue was rated as Moderate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Adjacent Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Read Application Data; Execute Unauthorized Code or Commands
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
