CVE-2013-4325

medium HPE
CVSS v3 Base Score
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C
EPSS Score
0.1%
Exploitation probability in 30 days
Top 80% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
M
Confidentiality
C
Integrity
C
Availability
C
Published: September 23, 2013 (4616 days ago)
Last Modified: April 29, 2026
Vendor: HPE
Source: NVD

Description

The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.

CWE

CWE-264

Affected Products

hp linux imaging and printing project

References

🔗 lists.opensuse.org 🔗 lists.opensuse.org 🔗 rhn.redhat.com 🔗 www.debian.org 🔗 www.ubuntu.com