CVE-2026-48980

Katalog CVE

CVSS 6.3 · Medium EPSS 0,18%

Kerentanan External Initialization of Trusted Variables or Data Stores. Skor CVSS 3.1 6.3 (Medium) menurut github.com.

Deskripsi (NVD)

pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environment variables influence whether a current session is local or remote, and a PAM module that runs in the context of setuid binaries (sudo, su), getenv() returns attacker-controlled values whenever the process environment has been manipulated by a local user. This issue has been fixed in version 0.9.2.

Rincian

Terbit di NVD

18 Juni 2026

Terakhir diubah

22 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.3 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-454: External Initialization of Trusted Variables or Data Stores
CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/mcdope/pam_usb/releases/tag/0.9.2
• https://github.com/mcdope/pam_usb/security/advisories/GHSA-qr83-mf3h-fvqr