CVE-2024-9312

{"id": "CVE-2024-9312", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}]}, "published": "2024-10-10T14:15:05.863", "references": [{"url": "https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2", "source": "security@ubuntu.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-9312", "source": "security@ubuntu.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-286"}]}], "descriptions": [{"lang": "en", "value": "Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges."}, {"lang": "es", "value": "Authd, hasta la versi\u00f3n 0.3.6, no aleatorizaba lo suficiente los identificadores de usuario para evitar colisiones. Un atacante local que pudiera registrar nombres de usuario podr\u00eda falsificar el identificador de otro usuario y obtener sus privilegios."}], "lastModified": "2024-10-15T12:58:51.050", "sourceIdentifier": "security@ubuntu.com"}