{"id":"CVE-2023-28144","aliases":["DEBIAN-CVE-2023-28144","EUVD-2023-31855","GHSA-r4wr-r3pf-8cvw","UBUNTU-CVE-2023-28144","openSUSE-SU-2024:12782-1"],"status":"published","title":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege...","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00291,"percentile":0.21904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2023-03-14T00:00:00Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"hotspot","fixed_in":["1.4.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"hotspot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-2","1.6.0-0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"hotspot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0+git20190211-1ubuntu1","1.1.0+git20190211-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"hotspot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"hotspot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-2ubuntu1","1.3.0-2ubuntu3","1.3.0-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"hotspot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hotspot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1.1"}]}]}],"products":[{"vendor":"kdab","product":"hotspot"}],"references":[{"url":"https://github.com/KDAB/hotspot/releases","tags":["x_transferred","Release Notes","package","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/03/14/8","tags":["x_transferred","Exploit","Mailing List","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28144","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4wr-r3pf-8cvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28144.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28144","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28144","tags":["report"]},{"url":"https://github.com/KDAB/hotspot/commit/65a246ce9196462081483fd07d97678dcfe36b9c","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28144","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28144","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-28144","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T00:00:00Z","modified":"2025-02-27T19:55:05.944Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:35:32.376766Z"}],"euvd":[{"id":"EUVD-2023-31855","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T00:00:00Z","modified":"2025-02-27T19:55:05Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:21.911964Z"}],"ghsa":[{"id":"GHSA-r4wr-r3pf-8cvw","title":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege...","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T21:30:22Z","modified":"2023-03-29T05:07:28Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:54:24.674255Z"}],"nvd":[{"id":"CVE-2023-28144","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T19:15:10.643Z","modified":"2026-06-17T05:46:57.76Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"CVE-2023-28144","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T00:00:00Z","modified":"2026-10-28T02:31:09.607958566Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28144","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T19:15:10.643Z","modified":"2026-10-26T18:00:45.894120172Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-28144","description":"KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls.","status":"published","published":"2023-03-14T19:15:00Z","modified":"2026-10-17T12:57:18.049801406Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"openSUSE-SU-2024:12782-1","title":"hotspot-1.4.1-1.1 on GA media","description":"These are all security issues fixed in the hotspot-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:37.875477Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}