Vulnerability · Published Oct 4, 2023 · Assigned by INCIBE
CVE-2021-3784Garuda Linux Improper Authorization
Medium 5.3
In plain English
A medium-severity improper authentication in Garuda Linux from Garuda Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
Garuda Linux performs an insecure user creation and authentication that allows any user to impersonate the created account. By creating users from the 'Garuda settings manager', an insecure procedure is performed that keeps the created user without an assigned password during some seconds. This could allow a potential attacker to exploit this vulnerability in order to authenticate without knowing the password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Garuda Linux | Garuda Linux | all versions |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L