CVE-2023-5616

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Canonical Ltd.	Ubuntu's gnome-control-center	>= 1:45, < 1:45.0-1ubuntu3.1; >= 1:44, < 1:44.0-1ubuntu6.1; >= 1:41, < 1:41.7-0ubuntu0.22.04.8; >= 1:3, < 1:3.36.5-0ubuntu4.1

References

https://bugs.launchpad.net/ubuntu/+source/gnome-control-center/+bug/2039577Exploit, Issue Tracking
https://ubuntu.com/security/CVE-2023-5616Vendor Advisory
https://ubuntu.com/security/notices/USN-6554-1Vendor Advisory

Timeline

Published: Apr 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-56175.3Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.1.0.0 and 9.3.0.6, including 9.5.x and 8.3.x, display the version of CVE-2023-56185.4The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and inc CVE-2023-56205.4The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, so CVE-2023-56214.8The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions u CVE-2023-56228.8Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows CVE-2023-56237.8NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM pri CVE-2023-56247.2Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter CVE-2023-56257.5A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch CVE-2023-56268.8Cross-Site Request Forgery (CSRF) in GitHub repository pkp/ojs prior to 3.3.0-16.CVE-2023-56277.5A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the CVE-2023-56296.1A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phishi CVE-2023-56304.9A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware