CVE-2023-43090 Gnome-shell: screenshot tool allows viewing open windows when session is locked
An unauthenticated local user can bypass the GNOME Shell lock screen to view open windows using screenshot tool keyboard shortcuts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43090?
CVE-2023-43090 is a medium-severity vulnerability in Fedoraproject Fedora, published on 22 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
Weakness: CWE-862
Which versions are affected by CVE-2023-43090?
It affects 2 products.
Linux distribution packages (1)
gnome-shell openSUSE:Tumbleweed | All versions | 45.0-2.1 |
Products include Fedoraproject Fedora, Gnome Gnome-Shell.
How do I fix CVE-2023-43090?
Apply the vendor's patch.
Is CVE-2023-43090 being exploited?
There is no known exploitation of CVE-2023-43090 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2023-43090, DSA-5501-1, GHSA-6wp3-hhxh-4vfp, MGASA-2023-0311, openSUSE-SU-2024:13251-1.