CVE-2019-3811 | Date: (C)2019-06-17 (M)2024-03-08 |
A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's filesystem access to within their home directory through chroot() etc. All versions before 2.1 are vulnerable.
CVSS Score and Metrics +CVSS Score and Metrics -CVSS V3 Severity: | CVSS V2 Severity: |
CVSS Score : 5.2 | CVSS Score : 2.7 |
Exploit Score: 1.5 | Exploit Score: 5.1 |
Impact Score: 3.6 | Impact Score: 2.9 |
|
CVSS V3 Metrics: | CVSS V2 Metrics: |
Attack Vector: ADJACENT_NETWORK | Access Vector: ADJACENT_NETWORK |
Attack Complexity: LOW | Access Complexity: LOW |
Privileges Required: LOW | Authentication: SINGLE |
User Interaction: REQUIRED | Confidentiality: NONE |
Scope: UNCHANGED | Integrity: NONE |
Confidentiality: NONE | Availability: PARTIAL |
Integrity: NONE | |
Availability: HIGH | |
| |