CVE-2023-5182
Assigner: canonical
Published: 2023-10-06T23:28:48.953Z
State: PUBLISHED
affected: packageName: subiquity
product: subiquity
vendor: Canonical Ltd.
repo: https://github.com/canonical/subiquity
platforms: Linux
versions: status: affected
version: 0
lessThanOrEqual: 23.09.1
versionType: semver
descriptions: value: Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege.
datePublic: 2023-10-04T00:00:00.000Z
problemTypes: descriptions: cweId: CWE-532
description: CWE-532
type: CWE
credits: type: finder
value: Patric Åhlin
type: finder
value: Johan Hortling
metrics: format: CVSS
cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 5.5
baseSeverity: MEDIUM