CVE-2024-37408

7.3 highEPSS 0.3%

High (7.3). EPSS 0.3% chance of exploitation in the next 30 days.

fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pam_fprintd.so to front-ends that implement a proper attention mechanism, not modifying pam_fprintd.so or fprintd.

Severity

CVSS 3.1

7.3 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2024-06-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

http://www.openwall.com/lists/oss-security/2024/06/13/3
http://www.openwall.com/lists/oss-security/2024/06/14/1
http://www.openwall.com/lists/oss-security/2024/06/14/2
http://www.openwall.com/lists/oss-security/2024/06/14/3
https://gitlab.freedesktop.org/libfprint/fprintd/-/releases

Check your stack JSON