« Volver al listado

CVE-2023-0092

Estado: AnalizadaMedia (4.9)—

An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Canonical — Juju

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-0092",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0092",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-07T16:10:08.920084Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@ubuntu.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical Ltd.",
          "product": "Juju",
          "versions": [
            {
              "status": "affected",
              "version": "2.9.22",
              "lessThan": "2.9.38",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.0.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.9.38",
              "lessThan": "3.0.3",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "juju"
        }
      ]
    }
  ],
  "published": "2025-01-31T02:15:28.550",
  "references": [
    {
      "url": "https://github.com/advisories/GHSA-x5rv-w9pm-8qp8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556",
      "tags": [
        "Patch"
      ],
      "source": "security@ubuntu.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem."
    },
    {
      "lang": "es",
      "value": "Un usuario autenticado que tiene acceso de lectura al modelo del controlador juju puede construir una solicitud remota para descargar un archivo arbitrario del sistema de archivos del controlador."
    }
  ],
  "lastModified": "2026-06-17T05:24:45.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29A9B22F-D7BC-4AC4-924C-5C9B2B8C418E",
              "versionEndExcluding": "2.9.38",
              "versionStartIncluding": "2.9.22"
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8020F084-E9D9-4865-BB99-1E2F6851FD97",
              "versionEndExcluding": "3.0.3",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}