CVE-2019-25058 — Incorrect Authorization in Project Usbguard

CWE-863 — Incorrect AuthorizationCWE-1220 — Insufficient Granularity of Access Control6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 91.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Usbguard Project UsbguardDebian UsbguardDebian Linux+2 more
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/usbguard< usbguard 1.1.0+ds-2 (bookworm)
▶Debianusbguard_project/usbguard< 1.1.0+ds-2+2

Also affects: Debian Linux 9.0, Fedora 34, 35, 36

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p5wh-m4gj-x2mr: An issue was discovered in USBGuard before 1↗2022-02-25
▶
OSV
CVE-2019-25058: An issue was discovered in USBGuard before 1↗2022-02-24
▶

📋Vendor Advisories

3
Red Hat
usbguard: Fix unauthorized access via D-Bus↗2022-02-24
▶
Microsoft
An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running an unprivileged user could make USBGuard allow all USB devices to be connected in the future.↗2022-02-08
▶
Debian
CVE-2019-25058: usbguard - An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-d...↗2019
▶
CVE-2019-25058 — Incorrect Authorization | cvebase