Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2019-14822

Disclosure Date: November 25, 2019
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
7.1 High
Impact Score:
5.2
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
None

General Information

Vendors

  • canonical,
  • ibus project,
  • oracle,
  • redhat

Products

  • enterprise linux 7.0,
  • enterprise linux 8.0,
  • ibus,
  • ubuntu linux 16.04,
  • ubuntu linux 18.04,
  • ubuntu linux 19.10,
  • zfs storage appliance kit 8.8

Additional Info

Technical Analysis