CVE-2018-14345
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the...
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
CVE-2018-14345- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-287, CWE-613
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
CVE-2018-14345- Updated
- 2026-11-02
EUVDEUVD-2018-6266 No score
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
EUVD-2018-6266- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wvx-qq9g-8hh9
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the...
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
GHSA-4wvx-qq9g-8hh9- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
CVE-2018-14345- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-14345
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
DEBIAN-CVE-2018-14345- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-14345
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
- Record
UBUNTU-CVE-2018-14345- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11376-1 No score
sddm-0.19.0-4.2 on GA media
These are all security issues fixed in the sddm-0.19.0-4.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11376-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sddmDebian:12 |
before 0.18.0-1 | 0.18.0-1 |
sddmDebian:13 |
before 0.18.0-1 | 0.18.0-1 |
sddmDebian:14 |
before 0.18.0-1 | 0.18.0-1 |
sddmUbuntu:16.04:LTS |
All versions, plus listed versions 0.11.0-0ubuntu110.11.0-0ubuntu120.13.0-1ubuntu10.13.0-1ubuntu30.13.0-1ubuntu40.13.0-1ubuntu5 |
None known |
sddmUbuntu:18.04:LTS |
All versions, plus listed versions 0.14.0-4ubuntu10.14.0-4ubuntu20.17.0-1ubuntu10.17.0-1ubuntu20.17.0-1ubuntu3 Show 4 moreShow less0.17.0-1ubuntu40.17.0-1ubuntu50.17.0-1ubuntu60.17.0-1ubuntu7 |
None known |
sddmopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.19.0-4.2 | 0.19.0-4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-14345 is a high vulnerability (CVSS 7.5) in Sddm Project Sddm, published July 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in sddm 0.18.0-1.
References
bugzilla.suse.com/show_bug.cgi?id=1101450
github.com/sddm/sddm/commit/147cec383892d143b5e02daa70f1e7def50f5d98
nvd.nist.gov/vuln/detail/CVE-2018-14345
security-tracker.debian.org/tracker/CVE-2018-14345
ubuntu.com/security/CVE-2018-14345
cve.org/CVERecord?id=CVE-2018-14345
suse.com/security/cve/CVE-2018-14345