CVE-2015-1320 Probe-and-enlist for SeaMicro chassis writes password to the log

What is CVE-2015-1320?

CVE-2015-1320 is a medium-severity vulnerability in Ubuntu MAAS, published on 22 Apr 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.

Weakness: CWE-255

Which versions are affected by CVE-2015-1320?

It affects 1 product.

Products include Canonical Metal as a Service.

How do I fix CVE-2015-1320?

No fix has been published for CVE-2015-1320 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-1320 being exploited?

There is no known exploitation of CVE-2015-1320 in the wild and no public exploit code.

Other vulnerabilities in Ubuntu MAAS

• CVE-2024-6107 Auth bypass in MAAS Critical 9.6
• CVE-2014-1427 MAAS API vulnerable to CSRF attack Critical 9.6
• CVE-2014-1426 get_file_by_name does not check owner High 8.6
• CVE-2014-1428 uuid.uuid1() is not suitable as an unguessable identifier/token Low 2.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rh3g-x45r-f376.