CVE-2014-1423

🗓️ 07 May 2020 22:25:16Reported by canonicalType

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2014-1423	8 May 202002:36	–	circl
Cvelist	CVE-2014-1423 Online Accounts Signon daemon gives out all oauth tokens to any app	7 May 202022:25	–	cvelist
EUVD	EUVD-2014-1499	7 Oct 202500:30	–	euvd
NVD	CVE-2014-1423	7 May 202023:15	–	nvd
Prion	Information disclosure	7 May 202023:15	–	prion
UbuntuCve	CVE-2014-1423	7 May 202023:15	–	ubuntucve

NVD

Node

signond_project signondRange<8.57+15.04.20141127.1-0ubuntu1

Node

ubports ubuntu_touchMatch-

[
  {
    "product": "signon",
    "vendor": "Ubuntu",
    "versions": [
      {
        "lessThan": "8.57+15.04.20141127.1-0ubuntu1",
        "status": "affected",
        "version": "Ubuntu 15.04 signon",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
bazaar	www.bazaar.launchpad.net/~online-accounts/signon/upstream/revision/645
bugs	www.bugs.launchpad.net/ubuntu/+source/signon/+bug/1392380
bazaar	www.bazaar.launchpad.net/~online-accounts/signon/upstream/revision/644

21 Nov 2024 02:04Current

5.4Medium risk

Vulners AI Score5.4

CVSS 24.3

CVSS 3.15.5 - 5.9

EPSS0.00207

CWE-522