Vulnerability record/PUBLISHED/Published Oct 2, 2024 10:12:32 UTC
CVE-2024-8037
Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.
Base score6.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityHighAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authoritycanonical
Last updatedNov 1, 2024 15:31:40 UTC
PublishedOct 2, 2024 10:12:32 UTC
ReservedAug 21, 2024 00:45:34 UTC
Credits
- Pedro Guimaraes
- Harry Pidcock
- Mark Esler