Read the docs
TI-2020-11259 Aliases CVE-2020-14391GHSA-95g9-pcvg-9462

Insufficiently protected credentials in gnome-settings-daemon

Priority LOW 25CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-522.

Summary

A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality.

Why it matters now

EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—gnome-settings-daemonRed Hat Enterprise Linux 8 versions prior to 8.2—No fix listedCNA
  • gnome-settings-daemon Vendor— Affected Red Hat Enterprise Linux 8 versions prior to 8.2 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:gnome:control_center:-:*:*:*:*:*:*:*not specified by NVDVulnerableGNOME
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:*8.2Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*8.2Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:*8.2Running onRed Hat
  • cpe:2.3:a:gnome:control_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GNOME
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Running on ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2021:0266 Released 2021-01-26 · Red Hat rating Moderate
    gnome-settings-daemon security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) gnome-settings-daemon-3.32.0-9.el8_2.1
  • RHSA-2020:4451 Released 2020-11-04 · Red Hat rating Moderate
    GNOME security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) LibRaw-devel-0.19.5-2.el8
    • Red Hat Enterprise Linux AppStream (v. 8) LibRaw-0.19.5-2.el8, gnome-settings-daemon-3.32.0-11.el8, webkit2gtk3-2.28.4-1.el8 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4451
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:0266
Not affected: 5 products
  • Red Hat CodeReady Linux Builder (v. 8)
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux BaseOS (v. 8)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14391
  2. 2026-10-03 Alias added: GHSA-95g9-pcvg-9462

References

Advisory 1

  • TI-2023-05169 Authentication bypass by spoofing in Canonical Ubuntu's gnome-control-center CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences