« Volver al listado

CVE-2024-6984

Estado: ModificadaBaja (3.8)—

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Canonical — Juju

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6984",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6984",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-29T14:37:36.928450Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ubuntu.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.8,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical Ltd.",
          "product": "Juju",
          "versions": [
            {
              "status": "affected",
              "version": "3.5",
              "lessThan": "3.5.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.4",
              "lessThan": "3.4.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.3",
              "lessThan": "3.3.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.1",
              "lessThan": "3.1.9",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.9",
              "lessThan": "2.9.50",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux",
            "MacOS",
            "Windows"
          ],
          "packageName": "juju",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*"
          ],
          "vendor": "canonical",
          "product": "juju",
          "versions": [
            {
              "status": "affected",
              "version": "2.9",
              "lessThan": "2.9.50",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.1",
              "lessThan": "3.1.9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.3",
              "lessThan": "3.3.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.4",
              "lessThan": "3.4.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.5",
              "lessThan": "3.5.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-29T14:15:04.477",
  "references": [
    {
      "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6984",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/juju/juju/commit/da929676853092a29ddf8d589468cf85ba3efaf2",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/juju/juju/security/advisories/GHSA-6vjm-54vp-mxhx",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6984",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@ubuntu.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm."
    },
    {
      "lang": "es",
      "value": " Se descubrió un problema en Juju que resultó en la filtración del ID de contexto confidencial, que permite a un atacante local sin privilegios acceder a otros datos o relaciones confidenciales accesibles al acceso local."
    }
  ],
  "lastModified": "2026-06-17T08:19:07.647",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A53137FD-EC95-4BB0-87AE-5265D8B20C44",
              "versionEndExcluding": "2.9.50",
              "versionStartIncluding": "2.9"
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4492C790-2A93-4532-8BBA-FAAABE094605",
              "versionEndExcluding": "3.1.9",
              "versionStartIncluding": "3.1"
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2411D179-5948-4695-8774-3FB037530AC2",
              "versionEndExcluding": "3.3.6",
              "versionStartIncluding": "3.3"
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63C146EF-AF30-4A6E-97A5-11C387534EA2",
              "versionEndExcluding": "3.4.5",
              "versionStartIncluding": "3.4"
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34FB1891-C153-4F19-8C3B-F2332BF21D7B",
              "versionEndExcluding": "3.5.3",
              "versionStartIncluding": "3.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}