CVE-2022-24950

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada eternal terminal project eternal terminal. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().

Rincian

Terbit di NVD

16 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3 patch · advisory pihak ketiga
• https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85gw-pchc-4rf3 exploit · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/02/16/1