CVE-2017-9232

Aliases:GHSA-j3hp-pv6v-rgrxGO-2025-3639
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 28 May 2017, 00:00
Last modified:05 Aug 2024, 17:02

Vulnerability Summary

Overall Risk (default)
critical
90/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
82.08% CRITICAL
82% probability +0.47%
KEV
Not listed
Ransomware
No reports
Public exploits
3 found
Dark Web
Not detected

Timeline

28 May 2017, 00:00
Published
Vulnerability first disclosed
05 Aug 2024, 17:02
Last Modified
Vulnerability information updated

Description

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

CVSS Metrics

  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 82.08%• Percentile: 99%

Techniques & Countermeasures

  • CWE-862•Missing Authorization

    The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

  • canonical•juju

    ≤ 1.25.12 | 2.0.0 | 2.0.0:alpha1 | 2.0.0:alpha2 | 2.0.0:beta1 | 2.0.0:beta10 | 2.0.0:beta11 | 2.0.0:beta12 | 2.0.0:beta13 | 2.0.0:beta14 | 2.0.0:beta15 | 2.0.0:beta16 | 2.0.0:beta17 | 2.0.0:beta18 | 2.0.0:beta2 | 2.0.0:beta3 | 2.0.0:beta4 | 2.0.0:beta5 | 2.0.0:beta6 | 2.0.0:beta7 | 2.0.0:beta8 | 2.0.0:beta9 | 2.0.0:rc1 | 2.0.0:rc2 | 2.0.0:rc3 | 2.0.1 | 2.0.2 | 2.0.3 | 2.1.0 | 2.1.0:beta1 | 2.1.0:beta2 | 2.1.0:beta3 | 2.1.0:beta4 | 2.1.0:beta5 | 2.1.0:rc1 | 2.1.0:rc2 | 2.1.1 | 2.1.2

  • github.com/juju•juju

    < 0.0.0-20170524231039-0417178a3c28

References (8)