CVE-2022-23242 MEDIUM

CVE-2022-23242: TeamViewer Linux - Deletion command not properly executed after process crash

Vendor Teamviewer
Product TeamViewer for Linux
Published March 23, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash connection password or local authenticated access to the machine would have allowed to establish a remote connection by reusing the not properly deleted connection password.

Key dates

02Disclosure timeline

March 23, 2022 CVE published
September 16, 2024 Record updated