CVE-2024-6388 MEDIUM

CVE-2024-6388

Vendor Canonical Ltd.
Product Ubuntu Advantage Desktop Pro
Weakness CWE-497
Published June 27, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.

Key dates

02Disclosure timeline

June 27, 2024 CVE published
August 1, 2024 Record updated