CVE-2023-5182

Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182	Patch Third Party Advisory
https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d74d00886001e38eaa1c	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:canonical:subiquity:*:*:*:*:*:*:*:*

History

11 Oct 2023, 18:05

Type	Values Removed	Values Added
First Time		Canonical subiquity Canonical
CWE		CWE-532
CPE		cpe:2.3:a:canonical:subiquity::::::::
References	~~(MISC) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182 -~~	(MISC) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182 - Patch, Third Party Advisory
References	~~(MISC) https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d74d00886001e38eaa1c -~~	(MISC) https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d74d00886001e38eaa1c - Patch
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5

07 Oct 2023, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-07 00:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-5182

Mitre link : CVE-2023-5182

CVE.ORG link : CVE-2023-5182

JSON object : View

Products Affected

canonical

subiquity

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2023-5182", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2023-10-07T00:15:11.597", "references": [{"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5182", "tags": ["Patch", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/subiquity/pull/1820/commits/62e126896fb063808767d74d00886001e38eaa1c", "tags": ["Patch"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege."}, {"lang": "es", "value": "Los datos confidenciales podr\u00edan quedar expuestos en los registros de subiquity versi\u00f3n 23.09.1 y anteriores. Un atacante del grupo adm podr\u00eda usar esta informaci\u00f3n para encontrar contrase\u00f1as cifradas y posiblemente aumentar sus privilegios."}], "lastModified": "2023-10-11T18:05:32.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:subiquity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98E0FBB2-EC64-4E69-B884-BDA9F6DCEBE8", "versionEndIncluding": "23.09.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}