CVEvulnerability
CVE-2022-24950
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-362
Description
A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().
Affected configurations
• eternal terminal project eternal terminal (< 6.2.0)
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://www.openwall.com/lists/oss-security/2023/02/16/1 www.openwall.com
- https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3 Patch, Third Party Advisory
- https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85gw-pchc-4rf3 Exploit, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/16/1 www.openwall.com
- https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3 Patch, Third Party Advisory
- https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85gw-pchc-4rf3 Exploit, Third Party Advisory