CVE-2020-16125: gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu…

PriorityP425medium6.8CVSS 3.1

AVPACLPRNUINSUCHIHAH

EPSS

1.11%

61.8th percentile

gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a local user to create a new privileged account.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	gdm3	< gdm3 3.38.2-1 (bookworm)	gdm3 3.38.2-1 (bookworm)
gnome	gdm3	>= 0 < 3.38.2-1	3.38.2-1
gnome	gdm3	>= 0 < 3.38.2-1	3.38.2-1
gnome	gdm3	>= 0 < 3.38.2-1	3.38.2-1
gnome	gdm3	>= 0 < 3.38.2-1	3.38.2-1
gnome	gdm3	>= 3.36 < 3.36.4	3.36.4
gnome	gdm3	>= 3.38 < 3.38.2	3.38.2
gnome	gnome_display_manager	< 3.36.2	3.36.2
gnome	gnome_display_manager	>= 3.38.0 < 3.38.2	3.38.2

CVSS provenance

nvdv3.16.8MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

osv6.8MEDIUM

vendor_debian7.2HIGH

vendor_redhat7.2HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.