CVE-2022-1804 - Vulnerability Details - OpenCVE

accountsservice no longer drops permissions when writting .pam_environment

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250
https://ubuntu.com/security/notices/USN-5439-1

History

Tue, 25 Mar 2025 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 25 Mar 2025 12:30:00 +0000

Type	Values Removed	Values Added
Description		accountsservice no longer drops permissions when writting .pam_environment
Title		Accountsservice incorrectly drops privileges
Weaknesses		CWE-269
References		https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250 https://ubuntu.com/security/notices/USN-5439-1
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2025-03-25T12:28:08.041Z

Updated: 2025-03-25T12:58:47.368Z

Reserved: 2022-05-19T23:57:52.655Z

Link: CVE-2022-1804

Vulnrichment

Updated: 2025-03-25T12:58:41.743Z

NVD

Status : Received

Published: 2025-03-25T13:15:38.703

Modified: 2025-03-25T13:15:38.703

Link: CVE-2022-1804

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-1804", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2022-05-19T23:57:52.655Z", "datePublished": "2025-03-25T12:28:08.041Z", "dateUpdated": "2025-03-25T12:58:47.368Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "accountsservice", "platforms": ["Linux"], "product": "Linux", "repo": "https://gitlab.freedesktop.org/accountsservice/accountsservice", "vendor": "Ubuntu", "versions": [{"lessThan": "22.07.5-2ubuntu1.3", "status": "affected", "version": "0.6.55-3ubuntu1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Gunnar Hjalmarsson"}, {"lang": "en", "type": "analyst", "value": "Marc Deslauriers"}, {"lang": "en", "type": "coordinator", "value": "Seth Arnold"}], "datePublic": "2022-05-23T23:00:00.000Z", "descriptions": [{"lang": "en", "value": "accountsservice no longer drops permissions when writting .pam_environment"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["issue-tracking"], "url": "https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250"}, {"tags": ["release-notes"], "url": "https://ubuntu.com/security/notices/USN-5439-1"}], "source": {"discovery": "UNKNOWN"}, "title": "Accountsservice incorrectly drops privileges", "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-03-25T12:28:08.041Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-25T12:58:36.536196Z", "id": "CVE-2022-1804", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-25T12:58:47.368Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-1804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-25T12:58:36.536196Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-25T12:58:41.743Z"}}], "cna": {"title": "Accountsservice incorrectly drops privileges", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Gunnar Hjalmarsson"}, {"lang": "en", "type": "analyst", "value": "Marc Deslauriers"}, {"lang": "en", "type": "coordinator", "value": "Seth Arnold"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://gitlab.freedesktop.org/accountsservice/accountsservice", "vendor": "Ubuntu", "product": "Linux", "versions": [{"status": "affected", "version": "0.6.55-3ubuntu1", "lessThan": "22.07.5-2ubuntu1.3", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "accountsservice", "defaultStatus": "unaffected"}], "datePublic": "2022-05-23T23:00:00.000Z", "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250", "tags": ["issue-tracking"]}, {"url": "https://ubuntu.com/security/notices/USN-5439-1", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "accountsservice no longer drops permissions when writting .pam_environment"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-03-25T12:28:08.041Z"}}}, "cveMetadata": {"cveId": "CVE-2022-1804", "state": "PUBLISHED", "dateUpdated": "2025-03-25T12:58:47.368Z", "dateReserved": "2022-05-19T23:57:52.655Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2025-03-25T12:28:08.041Z", "assignerShortName": "canonical"}, "dataVersion": "5.1"}