CVE-2020-25697 — Missing Authentication for Critical Function in X.org Foundation Xorg-x11-server

CWE-306 — Missing Authentication for Critical Function CWE-362 — Race Condition5 documents5 sources

Severity

7.0HIGHNVD

EPSS

0.0%

top 85.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

THE X.org Foundation Xorg-x11-server

Timeline

PublishedMay 26

Latest updateMay 24

Description

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages1 packages

▶CVEListV5the_x.org_foundation/xorg-x11-serverAll

🔴Vulnerability Details

GHSA

GHSA-qrj9-jg63-p8hg: A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients↗2022-05-24

▶

CVEList

CVE-2020-25697: A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients↗2021-05-26

▶

OSV

CVE-2020-25697: A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients↗2021-05-26

▶

📋Vendor Advisories

Red Hat

xorg-x11-server: local privilege escalation↗2020-11-09

▶