{"id":"CVE-2022-21946","aliases":["EUVD-2022-27102","GHSA-wj8w-cmvq-mfv8","openSUSE-SU-2024:11924-1"],"status":"published","title":"suddoers configuration for cscreen not restrictive enough","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0026,"percentile":0.17875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-732"],"published":"2022-03-16T10:05:14Z","modified":"2026-10-28T02:30:26Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cscreen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"cscreen"},{"vendor":"opensuse","product":"factory"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1196451","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21946","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wj8w-cmvq-mfv8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21946.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-21946","title":"suddoers configuration for cscreen not restrictive enough","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.","status":"published","published":"2022-03-16T10:05:14.562Z","modified":"2024-09-17T01:21:54.785Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-27102","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.","status":"published","published":"2022-03-16T10:05:14Z","modified":"2024-09-17T01:21:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:50.234993Z"}],"ghsa":[{"id":"GHSA-wj8w-cmvq-mfv8","title":"A Improper Privilege Management vulnerability in the sudoers configuration in cscreen of openSUSE...","description":"A Improper Privilege Management vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.","status":"published","published":"2022-03-17T00:00:46Z","modified":"2023-04-14T21:30:25Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-732"],"updated_at":"2026-11-02T14:54:30.36158Z"}],"nvd":[{"id":"CVE-2022-21946","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.","status":"published","published":"2022-03-16T10:15:08.34Z","modified":"2026-06-17T04:27:20.043Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:07:14.24948Z"}],"osv":[{"id":"CVE-2022-21946","title":"suddoers configuration for cscreen not restrictive enough","description":"A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.","status":"published","published":"2022-03-16T10:05:14.562Z","modified":"2026-10-28T02:30:26.156729025Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"openSUSE-SU-2024:11924-1","title":"cscreen-1.4-1.1 on GA media","description":"These are all security issues fixed in the cscreen-1.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:53.202095Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}