CVE-2024-6388
5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Summary
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Canonical Ltd. | Ubuntu Advantage Desktop Pro | 0 < 1.12 | affected |
Weaknesses
- CWE-497: CWE-497
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
- https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944
- https://www.cve.org/CVERecord?id=CVE-2024-6388
- https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24
References
- https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944
- https://www.cve.org/CVERecord?id=CVE-2024-6388
- https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.