CVEvulnerability

CVE-2022-24986

7.8 HIGH Published 2022-02-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-02-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-362, CWE-668

Description

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands.

Affected configurations

• kde kcron (<= 21.12.2)

Related

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References