Vulnerability Details : CVE-2018-14665

Public exploit exists!
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
Published 2018-10-25 20:29:00
Updated 2019-10-22 23:15:10
Source Red Hat, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-14665

Probability of exploitation activity in the next 30 days: 3.21%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 90 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2018-14665

  • Xorg X11 Server SUID modulepath Privilege Escalation
    Disclosure Date: 2018-10-25
    First seen: 2020-04-26
    exploit/multi/local/xorg_x11_suid_server_modulepath
    This module attempts to gain root privileges with SUID Xorg X11 server versions 1.19.0 < 1.20.3. A permission check flaw exists for -modulepath and -logfile options when starting Xorg. This allows unprivileged users that can start the server the a
  • Xorg X11 Server SUID logfile Privilege Escalation
    Disclosure Date: 2018-10-25
    First seen: 2020-04-26
    exploit/multi/local/xorg_x11_suid_server
    This module attempts to gain root privileges with SUID Xorg X11 server versions 1.19.0 < 1.20.3. A permission check flaw exists for -modulepath and -logfile options when starting Xorg. This allows unprivileged users that can start the server the ab
  • Xorg X11 Server Local Privilege Escalation
    Disclosure Date: 2018-10-25
    First seen: 2020-04-26
    exploit/aix/local/xorg_x11_server
    WARNING: Successful execution of this module results in /etc/passwd being overwritten. This module is a port of the OpenBSD X11 Xorg exploit to run on AIX. A permission check flaw exists for -modulepath and -logfile options when starting Xorg. This allows unprivil

CVSS scores for CVE-2018-14665

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
7.2
 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C
3.9
10.0
 NIST
6.6
 MEDIUM CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.7
5.9
 NIST

CWE ids for CVE-2018-14665

  • The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-14665

Products affected by CVE-2018-14665

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close