CVE-2018-10852 LOW

CVE-2018-10852

Vendor [Unknown]

Product sssd

Weakness CWE-200 · Info exposure

Published June 26, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

3.8/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. This affects versions of SSSD before 1.16.3.

Key dates

02Disclosure timeline

June 26, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-10852 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2026-58026 $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces CVE-2026-58027 QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI CVE-2026-47124 Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members CVE-2026-45536 Netty: Unix-socket fd receive leaks descriptors when peer sends two at once CVE-2026-47176 Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel