CVE-2024-6984

2024-07-2914:15:04

CWE-209

canonical

web.nvd.nist.gov

juju

sensitive data

data leak

local attacker

context id

charm

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

Percentile

16.2%

JSON

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.

Affected configurations

Nvd

Node

canonicaljujuRange2.9–2.9.50

canonicaljujuRange3.1–3.1.9

canonicaljujuRange3.3–3.3.6

canonicaljujuRange3.4–3.4.5

canonicaljujuRange3.5–3.5.3

VendorProductVersionCPE
canonicaljuju*cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
canonical	juju	*	cpe:2.3:a:canonical:juju::::::::

CNA Affected

[
  {
    "vendor": "Canonical Ltd.",
    "product": "Juju",
    "platforms": [
      "Linux",
      "MacOS",
      "Windows"
    ],
    "packageName": "juju",
    "repo": "https://github.com/juju/juju",
    "versions": [
      {
        "status": "affected",
        "version": "3.5",
        "lessThan": "3.5.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.4",
        "lessThan": "3.4.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.3",
        "lessThan": "3.3.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "3.1",
        "lessThan": "3.1.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.9",
        "lessThan": "2.9.50",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]