Lucene search

CVE-2019-7304

🗓️ 23 Apr 2019 16:10:29Reported by canonicalType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 144 Views🌐 WEB

Canonical snapd before version 2.37.1 allows arbitrary root commands

Reporter	Title	Published	Views	Family All 20
Ubuntu	snapd vulnerability	12 Feb 201900:00	–	ubuntu
ThreatPost	Flaw in snapd Allows Root Access to Linux Servers	13 Feb 201915:20	–	threatpost
Packet Storm	snapd 2.37 (Ubuntu) dirty_sock Local Privilege Escalation	13 Feb 201900:00	–	packetstorm
Packet Storm	snapd 2.37 (Ubuntu) dirty_sock Local Privilege Escalation	13 Feb 201900:00	–	packetstorm
NVD	CVE-2019-7304	23 Apr 201916:29	–	nvd
Prion	Input validation	23 Apr 201916:29	–	prion
Tenable Nessus	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : snapd vulnerability (USN-3887-1)	13 Feb 201900:00	–	nessus
OpenVAS	Ubuntu: Security Advisory (USN-3887-1)	13 Feb 201900:00	–	openvas
Debian CVE	CVE-2019-7304	23 Apr 201916:29	–	debiancve
OSV	CVE-2019-7304	23 Apr 201916:29	–	osv

Nvd

Node

canonical snapdRange<2.37.1

Node

canonical ubuntu_linuxMatch14.04lts

canonical ubuntu_linuxMatch16.04lts

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch18.10

[
  {
    "product": "snapd",
    "vendor": "Canonical",
    "versions": [
      {
        "lessThan": "2.37.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
usn	www.usn.ubuntu.com/3887-1/
exploit-db	www.exploit-db.com/exploits/46362
exploit-db	www.exploit-db.com/exploits/46361

Parameter	Position	Path	Description	CWE
devmode	path	/v2/snaps	Vulnerable API endpoint used to install arbitrary snaps including a trojan that creates a new user.	CWE-863
snap	path	/v2/snaps	Vulnerable API endpoint used to install arbitrary snaps including a trojan that creates a new user.	CWE-863

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

23 Apr 2019 16:29Current

9.3High risk

Vulners AI Score9.3

CVSS210

CVSS38.8 - 9.8

EPSS0.85373

CWE-863