Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
probabilidade de exploração
0.2%top 94% das CVEs
exploração observada
nãonenhuma fonte reporta
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including DNS filtering and application limits without authentication.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pardus · pardus-parental-controlReferências
https://github.com/pardus/pardus-parental-controlhttps://github.com/pardus/pardus-parental-control/blob/4045f9513fa2d19ad9dbee25b39acb55a018c58e/polkit/tr.org.pardus.pkexec.parental-control.policy#L9-L21https://github.com/pardus/pardus-parental-control/commit/42d8373b6b8d9bf348e9378fb6ad4a2750d503e7https://github.com/pardus/pardus-parental-control/pull/5https://github.com/pardus/pardus-parental-control/releases/tag/debian%2F0.7.0https://www.vulncheck.com/advisories/pardus-parental-control-before-0.7.0-incorrect-authorization-via-ppcactivator-py