CVE-2023-43090
Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
- Record
CVE-2023-43090- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2023-47511
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
- Record
EUVD-2023-47511- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6wp3-hhxh-4vfp
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated...
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
- Record
GHSA-6wp3-hhxh-4vfp- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
- Record
CVE-2023-43090- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
- Record
CVE-2023-43090- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-43090
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
- Record
DEBIAN-CVE-2023-43090- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2023-0311 No score
Updated gnome-shell packages fix a security vulnerability
The updated packages fix a security vulnerability:
GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. (CVE-2023-43090)
- Record
MGASA-2023-0311- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13251-1 No score
gnome-extensions-45.0-2.1 on GA media
These are all security issues fixed in the gnome-extensions-45.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13251-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2576-1 No score
Security update for gnome-shell
This update for gnome-shell fixes the following issues:
- CVE-2024-36472: Fixed portal helper automatically launched without user confirmation (bsc#1225567)
- Record
SUSE-SU-2024:2576-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-shellDebian:12 |
before 43.6-1~deb12u2, plus listed versions 43.4-143.6-1~deb12u1 |
43.6-1~deb12u2 |
gnome-shellDebian:13 |
before 44.5-1 | 44.5-1 |
gnome-shellDebian:14 |
before 44.5-1 | 44.5-1 |
gnome-shellMageia:9 |
before 44.2-1.1.mga9 | 44.2-1.1.mga9 |
gnome-shellSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 2 CVEs |
before 45.3-150600.5.6.1 | 45.3-150600.5.6.1 |
gnome-shellSUSE:Linux Enterprise Workstation Extension 15 SP6 From an advisory covering 2 CVEs |
before 45.3-150600.5.6.1 | 45.3-150600.5.6.1 |
gnome-shellopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 45.3-150600.5.6.1 | 45.3-150600.5.6.1 |
gnome-shellopenSUSE:Tumbleweed |
before 45.0-2.1 | 45.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-43090 is a medium vulnerability (CVSS 5.5) in Gnome Gnome-shell, published September 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in gnome-shell 43.6-1~deb12u2.
References
access.redhat.com/security/cve/CVE-2023-43090
bugzilla.redhat.com/show_bug.cgi?id=2239087
gitlab.gnome.org/GNOME/gnome-shell/-/issues/6990
nvd.nist.gov/vuln/detail/CVE-2023-43090
github.com/advisories/GHSA-6wp3-hhxh-4vfp
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2023-43090
advisories.mageia.org/MGASA-2023-0311.html
bugs.mageia.org/show_bug.cgi?id=32320
ubuntu.com/security/notices/USN-6395-1
suse.com/support/update/announcement/2024/suse-su-20242576-1
bugzilla.suse.com/1215485