CVE-2024-9312 HIGH

CVE-2024-9312

Vendor Canonical Ltd.

Product Authd

Weakness CWE-286

Published October 10, 2024

Last update October 10, 2024

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Local

Attack complexity High

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Key dates

02Disclosure timeline

October 10, 2024 CVE published

October 10, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-9312 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/286.html

Related vulnerabilities

CVE-2024-9312

01Description

02Disclosure timeline

03References

04Related CVE