CVE-2023-43090: Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
Other sources
GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock restricted functionality of the screenshot tool.
Affected versions: 42, 43 prior to 43.9, 44 prior to 44.5
Discoverer/Credit: Mickael Karatekin at SysDream
References, additional information: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6990 https://gitlab.gnome.org/GNOME/gnome-shell/-/mergerequests/2944
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-43090?
CVE-2023-43090 is a vulnerability found in GNOME Shell that allows an unauthenticated local user to view windows of the locked desktop session.
How does the vulnerability in CVE-2023-43090 work?
The vulnerability in CVE-2023-43090 is due to GNOME Shell's lock screen allowing access to the screenshot tool, which can be used to unlock the restricted functionality and view windows of the locked session.
What is the severity of CVE-2023-43090?
The severity of CVE-2023-43090 is medium, with a CVSS score of 5.5.
Which software versions are affected by CVE-2023-43090?
GNOME Shell versions up to 43.9 and 44.5 are affected by CVE-2023-43090.
How can I fix CVE-2023-43090?
To fix CVE-2023-43090, update GNOME Shell to version 43.9 or higher.