CVE-2022-24950 Vulnerability Details

  /     /     /  

CVE-2022-24950 Metadata Quick Info

CVE Published: 16/08/2022 | CVE Updated: 03/08/2024 | CVE Year: 2022
Source: facebook | Vendor: Jason Gauci | Product: Eternal Terminal
Status : PUBLISHED

---

CVE-2022-24950 Description

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users\' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-362
CWE Name: Race Condition (CWE-362)
Source: Jason Gauci

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).