{"id":"CVE-2023-43090","aliases":["DEBIAN-CVE-2023-43090","DSA-5501-1","EUVD-2023-47511","GHSA-6wp3-hhxh-4vfp","MGASA-2023-0311","SUSE-SU-2024:2576-1","openSUSE-SU-2024:13251-1"],"status":"published","title":"Gnome-shell: screenshot tool allows viewing open windows when session is locked","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00302,"percentile":0.2321,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2023-09-18T00:00:00Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Debian:12","package":"gnome-shell","fixed_in":["43.6-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnome-shell","fixed_in":["44.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnome-shell","fixed_in":["44.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"gnome-shell","fixed_in":["44.2-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gnome-shell","fixed_in":["45.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.6-1~deb12u2"}]}],"versions":["43.4-1","43.6-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.6-1~deb12u2"}]}],"versions":["43.4-1","43.6-1~deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.2-1.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.3-150600.5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.3-150600.5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.3-150600.5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0-2.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"gnome-shell"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-43090","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239087","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6990","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2944","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43090","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6wp3-hhxh-4vfp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43090.json","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-43090","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0311.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32320","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6395-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242576-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215485","tags":["report"]},{"url":"https://bugzilla.suse.com/1225567","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36472","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-43090","title":"Gnome-shell: screenshot tool allows viewing open windows when session is locked","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","status":"published","published":"2023-09-22T05:02:08.801Z","modified":"2024-08-02T19:37:23.406Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:35:14.633899Z"}],"euvd":[{"id":"EUVD-2023-47511","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","status":"published","published":"2023-09-22T05:02:08Z","modified":"2024-08-02T19:37:23Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:00.127967Z"}],"ghsa":[{"id":"GHSA-6wp3-hhxh-4vfp","title":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated...","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","status":"published","published":"2023-09-22T06:30:19Z","modified":"2024-07-03T18:33:04Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:57:33.79017Z"}],"nvd":[{"id":"CVE-2023-43090","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","status":"published","published":"2023-09-22T06:15:09.81Z","modified":"2026-06-17T06:25:06.55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-43090","title":"Gnome-shell: screenshot tool allows viewing open windows when session is locked","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","status":"published","published":"2023-09-22T05:02:08.801Z","modified":"2026-10-28T02:30:27.263884589Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DEBIAN-CVE-2023-43090","description":"A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.","status":"published","published":"2023-09-22T06:15:09.81Z","modified":"2026-10-26T18:03:07.004962795Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"DSA-5501-1","title":"gnome-shell - security update","status":"published","published":"2023-09-18T00:00:00Z","modified":"2026-03-09T02:08:49.600885Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0311","title":"Updated gnome-shell packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\n\nGNOME Shell's lock screen allows an unauthenticated local user to view\nwindows of the locked desktop session by using keyboard shortcuts to\nunlock the restricted functionality of the screenshot tool.\n(CVE-2023-43090)\n","status":"published","published":"2023-11-09T12:55:51Z","modified":"2026-04-16T04:44:27.4534435Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13251-1","title":"gnome-extensions-45.0-2.1 on GA media","description":"These are all security issues fixed in the gnome-extensions-45.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:13.6568Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2024:2576-1","title":"Security update for gnome-shell","description":"This update for gnome-shell fixes the following issues:\n\n- CVE-2024-36472: Fixed portal helper automatically launched without user confirmation (bsc#1225567)\n","status":"published","published":"2024-07-22T10:35:48Z","modified":"2026-02-04T02:30:53.000634Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}