Описание
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
Ссылки
- Patch
- Issue TrackingPatch
- ExploitMitigationVendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:a:canonical:lxd:6.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
EPSS
Процентиль: 5%
0.0002
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-862
Связанные уязвимости
CVSS3: 4.3
ubuntu
26 дней назад
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
CVSS3: 4.3
debian
26 дней назад
Improper authorization in the API endpoint GET /1.0/certificates in Ca ...
github
25 дней назад
lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints
EPSS
Процентиль: 5%
0.0002
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-862