Vulnerability · Published Jun 5, 2023 · Assigned by VulDB

CVE-2023-3096KylinSoft kylin-software-properties changedSource access control

Medium 5.3

In plain English

A medium-severity improper access control in kylin-software-properties from KylinSoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 73.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. VDB-230686 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
KylinSoft	kylin-software-properties	n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.230686 vdb-entry, technical-description
https://vuldb.com/?ctiid.230686 signature, permissions-required
https://github.com/i900008/vulndb/blob/main/kylinos_vul1.md broken-link, exploit