« Volver al listado

CVE-2014-1423

Estado: ModificadaMedia (5.5)—

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Signond Project — SignondUbports — Ubuntu Touch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1423",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ubuntu.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "Ubuntu",
          "product": "signon",
          "versions": [
            {
              "status": "affected",
              "version": "Ubuntu 15.04 signon",
              "lessThan": "8.57+15.04.20141127.1-0ubuntu1",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-07T23:15:11.310",
  "references": [
    {
      "url": "http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/644",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/645",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://bugs.launchpad.net/ubuntu/+source/signon/+bug/1392380",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/644",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://bazaar.launchpad.net/~online-accounts/signon/upstream/revision/645",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/ubuntu/+source/signon/+bug/1392380",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ubuntu.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information."
    },
    {
      "lang": "es",
      "value": "signond versiones anteriores a  8.57+15.04.20141127.1-0ubuntu1, como es usado en Ubuntu Touch, no restringió apropiadamente las aplicaciones a partir de consultar los tokens oath debido a unas comprobaciones incorrectas y la falta de instalación de la signon-apparmor-extension. Un atacante podría usar esto para crear una aplicación de clics maliciosos que recopile tokens oauth para otras aplicaciones, exponiendo información confidencial."
    }
  ],
  "lastModified": "2026-06-17T00:04:52.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:signond_project:signond:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3F079AB-3D0F-4A6A-B2A8-A875199B78A9",
              "versionEndExcluding": "8.57\\+15.04.20141127.1-0ubuntu1"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ubports:ubuntu_touch:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5443E410-5EFD-4C9D-84E7-1EBE11780B52"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}