CVE-2024-6388 Information disclosure in Ubuntu Advantage Desktop Pro
Unprivileged users can read the Pro token due to plaintext argument passing in the Ubuntu Advantage Desktop Daemon.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-6388?
CVE-2024-6388 is a medium-severity vulnerability in Canonical Ltd. Ubuntu Advantage Desktop Pro, published on 27 Jun 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
Which versions are affected by CVE-2024-6388?
It affects 1 product.
Products include Canonical Ubuntu Advantage Desktop Daemon.
How do I fix CVE-2024-6388?
Upgrade to a fixed version.
Is CVE-2024-6388 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6388 exists.
Sources
Also known as GHSA-qr25-x8m6-w7qj, UBUNTU-CVE-2024-6388, USN-7063-1.