{
  "GSD": {
    "alias": "CVE-2022-40297",
    "description": "UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account\u0027s password.",
    "id": "GSD-2022-40297"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-40297"
      ],
      "details": "** DISPUTED ** UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account\u0027s password. NOTE: a third party states \"The described attack cannot be executed as demonstrated.\"",
      "id": "GSD-2022-40297",
      "modified": "2023-12-13T01:19:31.148658Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-40297",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** DISPUTED ** UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account\u0027s password. NOTE: a third party states \"The described attack cannot be executed as demonstrated.\""
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/filipkarc/PoC-ubuntutouch-pin-privesc",
            "refsource": "MISC",
            "url": "https://github.com/filipkarc/PoC-ubuntutouch-pin-privesc"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:ubports:ubuntu_touch:16.04:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1F0A62E6-CA62-4B4B-9679-205D4E68847B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account\u0027s password. NOTE: a third party states \"The described attack cannot be executed as demonstrated."
          },
          {
            "lang": "es",
            "value": "** EN DISPUTA ** UBports Ubuntu Touch versi\u00f3n 16.04, permite usar el c\u00f3digo de acceso de desbloqueo de pantalla para un shell privilegiado por medio de Sudo. Este c\u00f3digo de acceso es de s\u00f3lo cuatro d\u00edgitos, muy por debajo de la longitud/complejidad t\u00edpica para la contrase\u00f1a de una cuenta de usuario. NOTA: un tercero afirma \"El ataque descrito no puede ser ejecutado como se ha demostrado\""
          }
        ],
        "id": "CVE-2022-40297",
        "lastModified": "2024-04-11T01:16:39.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-09-09T00:15:08.793",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/filipkarc/PoC-ubuntutouch-pin-privesc"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-269"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}