Skip to content
Fencer Vulns
medium 6.0

CVE-2023-49347 json

Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated.

published 2023-12-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53330

cvss
6.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application.

Patch / fix

  • Ubuntu Budgie Budgie Extras v1.7.1
  • budgie-extras Debian 14, Debian 13 1.7.1-1

debian advisories DEBIAN-CVE-2023-49347

  • budgie-extras Ubuntu 22.04 LTS 1.4.0-1ubuntu3.1

ubuntu advisories UBUNTU-CVE-2023-49347

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Ubuntu Budgie Budgie Extras

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere
  • CWE-377 DEPRECATED: Insecure Temporary File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.