« Volver al listado

CVE-2022-23242

Estado: ModificadaMedia (4.2)—

TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash connection password or local authenticated access to the machine would have allowed to establish a remote connection by reusing the not properly deleted connection password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Teamviewer — Teamviewer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-23242",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 1.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@teamviewer.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.6
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@teamviewer.com",
      "affectedData": [
        {
          "vendor": "TeamViewer",
          "product": "TeamViewer for Linux",
          "versions": [
            {
              "status": "affected",
              "version": "15.27",
              "versionType": "custom",
              "lessThanOrEqual": "15.27"
            }
          ],
          "platforms": [
            "Linux"
          ]
        }
      ]
    }
  ],
  "published": "2022-03-23T16:15:08.450",
  "references": [
    {
      "url": "https://www.teamviewer.com/en/trust-center/security-bulletins/TV-2022-1001/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@teamviewer.com"
    },
    {
      "url": "https://www.teamviewer.com/en/trust-center/security-bulletins/TV-2022-1001/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-404"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash connection password or local authenticated access to the machine would have allowed to establish a remote connection by reusing the not properly deleted connection password."
    },
    {
      "lang": "es",
      "value": "TeamViewer Linux versiones anteriores a 15.28, no ejecutan correctamente un comando de borrado de la contraseña de conexión en caso de bloqueo del proceso. El conocimiento del evento de bloqueo y el ID de TeamViewer, así como la posesión de la contraseña de conexión anterior al bloqueo o el acceso local autenticado a la máquina, habrían permitido establecer una conexión remota al reusar la contraseña de conexión no eliminada correctamente"
    }
  ],
  "lastModified": "2026-06-17T04:29:43.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:teamviewer:teamviewer:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64BF4156-1817-414E-AF06-BBC63E768125",
              "versionEndExcluding": "15.28"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@teamviewer.com"
}