CVE-2019-3842

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

• CWE-285
• CWE-863

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlThird Party Advisory
• http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842Issue Tracking, Third Party Advisory
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2019/04/msg00022.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/
• https://www.exploit-db.com/exploits/46743/Exploit, Third Party Advisory, VDB Entry
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.htmlThird Party Advisory
• http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.htmlExploit, Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842Issue Tracking, Third Party Advisory
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2019/04/msg00022.htmlThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/
• https://www.exploit-db.com/exploits/46743/Exploit, Third Party Advisory, VDB Entry

Published

Apr 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3836It was discovered in gnutls before version 3.6.7 upstream th…5.9
• CVE-2019-3837It was found that the net_dma code in tcp_recvmsg() in the 2…6.1
• CVE-2019-3838It was found that the forceput operator could be extracted f…5.5
• CVE-2019-3839It was found that in ghostscript some privileged operators r…7.8
• CVE-2019-3840A NULL pointer dereference flaw was discovered in libvirt be…5.8
• CVE-2019-3841Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusiv…7.4
• CVE-2019-3843It was discovered that a systemd service that uses DynamicUs…7.8
• CVE-2019-3844It was discovered that a systemd service that uses DynamicUs…7.8
• CVE-2019-3845A lack of access control was found in the message queues mai…8
• CVE-2019-3846A flaw that allowed an attacker to corrupt memory and possib…8.8
• CVE-2019-3847A vulnerability was found in moodle before versions 3.6.3, 3…4.8
• CVE-2019-3848A vulnerability was found in moodle before versions 3.6.3, 3…4.3