{"id":"CVE-2023-32184","aliases":["EUVD-2023-36452","GHSA-6cr9-4pv5-j99r","openSUSE-SU-2023:0219-1","openSUSE-SU-2023:0230-1","openSUSE-SU-2024:13126-1"],"status":"published","title":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows...","description":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen\nThis issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00307,"percentile":0.23837,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-922"],"published":"2023-08-14T13:45:38Z","modified":"2026-06-17T05:58:16Z","fixes":[{"ecosystem":"SUSE:Package Hub 15 SP5","package":"opensuse-welcome","fixed_in":["0.1.9+git.35.4b9444a-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"opensuse-welcome","fixed_in":["0.1.9+git.35.4b9444a-bp155.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"opensuse-welcome","fixed_in":["0.1.9+git.0.66be0d8-bp154.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"opensuse-welcome","fixed_in":["0.1.9+git.0.66be0d8-bp154.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"opensuse-welcome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9+git.35.4b9444a-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"opensuse-welcome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9+git.35.4b9444a-bp155.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"opensuse-welcome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9+git.0.66be0d8-bp154.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"opensuse-welcome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9+git.0.66be0d8-bp154.2.6.1"}]}]}],"products":[{"vendor":"opensuse","product":"opensuse-welcome"},{"vendor":"opensuse","product":"welcome"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32184","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32184"},{"url":"https://github.com/advisories/GHSA-6cr9-4pv5-j99r"},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HSVERGEID7EOMQUUGEUFM6IS7QB7YYU3/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213708","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32184","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T452K3EYBY4FDSUL3JTDOFR56ND5D5OV/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-32184","description":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen\nThis issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.\n\n","status":"published","published":"2023-09-19T09:42:48.052Z","modified":"2024-09-25T14:24:19.579Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36452","description":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen\nThis issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.\n\n","status":"published","published":"2023-09-19T09:42:48Z","modified":"2024-09-25T14:24:19Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:12.924195Z"}],"ghsa":[{"id":"GHSA-6cr9-4pv5-j99r","title":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows...","description":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen\nThis issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.\n\n","status":"published","published":"2023-09-19T12:30:30Z","modified":"2024-04-04T07:44:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:56:54.282267Z"}],"nvd":[{"id":"CVE-2023-32184","description":"A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen\nThis issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a.\n\n","status":"published","published":"2023-09-19T10:15:12.497Z","modified":"2026-06-17T05:58:16.28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"openSUSE-SU-2023:0219-1","title":"Security update for opensuse-welcome","description":"This update for opensuse-welcome fixes the following issues:\n\nUpdate to version 0.1.9+git.35.4b9444a:\n\n* CVE-2023-32184: panellayouter: use QTemporaryFile for applyLayout() (boo#1213708).\n* Translation updates.\n","status":"published","published":"2023-08-14T13:45:38Z","modified":"2026-02-04T04:36:45.639012Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0230-1","title":"Security update for opensuse-welcome","description":"This update for opensuse-welcome fixes the following issues:\n\n- CVE-2023-32184: Fixed possible security issues when using the feature to change the Xfce\n  desktop layout, caused by a fixed temporary file path used in /tmp/layout\n  (boo#1213708)\n","status":"published","published":"2023-08-18T10:02:39Z","modified":"2026-02-04T04:14:02.870434Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13126-1","title":"opensuse-welcome-0.1.9+git.35.4b9444a-1.1 on GA media","description":"These are all security issues fixed in the opensuse-welcome-0.1.9+git.35.4b9444a-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:24.20902Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}