CVE-2024-5148

{
  "id": "CVE-2024-5148",
  "sourceIdentifier": "[email protected]",
  "published": "2024-09-02T12:15:19.910",
  "lastModified": "2026-11-05T14:16:58.560",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el paquete gnome-remote-desktop. El daemon del sistema gnome-remote-desktop realiza una validación inadecuada de los agentes de sesión mediante métodos D-Bus relacionados con la transición de una conexión de cliente desde la pantalla de inicio de sesión a la sesión de usuario. Como resultado, el certificado y la clave TLS de RDP del sistema pueden quedar expuestos a usuarios no autorizados. Esta falla permite que un usuario malintencionado del sistema tome el control de la conexión del cliente RDP durante la transición de la pantalla de inicio de sesión a la sesión de usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/GNOME/gnome-remote-desktop",
          "packageName": "gnome-remote-desktop",
          "versions": [
            {
              "version": "46.alpha",
              "lessThan": "46.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gnome-remote-desktop",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gnome-remote-desktop",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "gnome-remote-desktop",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2024-09-03T15:27:26.435046Z",
          "id": "CVE-2024-5148",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-5148",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282003",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196",
      "source": "[email protected]"
    }
  ]
}