CVE-2018-1116

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-285CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-111608.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).CVE-2018-111618.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).CVE-2018-111628.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).CVE-2018-111637.2Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).CVE-2018-111648.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).CVE-2018-111658.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).CVE-2018-111668.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).CVE-2018-111678.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).CVE-2018-111688.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).CVE-2018-111698.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).CVE-2018-11179.8ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManaCVE-2018-111708.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).