CVE-2024-6984

lowPriorität · verfolgen · 15EPSS 0.004 · 32. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 3.8 · low

Is it mine?

16 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 3.5–8.8

v3.13.8lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2 · Auswirkung 1.4

v3.18.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security@ubuntu.comAusnutzbarkeit 2 · Auswirkung 6

v3.18.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.13.5lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-209USprimärCWE-209USCWE-269USCWE-284US

betroffene Produkte (16)

Betroffene Produkte und Versionsbereiche.

Canonical Ltd. Juju2.9 → 2.9.50enisa_euvdEU
Canonical Ltd. Juju3.1 → 3.1.9enisa_euvdEU
Canonical Ltd. Juju3.3 → 3.3.5enisa_euvdEU
Canonical Ltd. Juju3.4 → 3.4.5enisa_euvdEU
Canonical Ltd. Juju3.5 → 3.5.3enisa_euvdEU
canonical juju2.9 → 2.9.50nvdUScpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*
canonical juju3.1 → 3.1.9nvdUScpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*
canonical juju3.3 → 3.3.6nvdUScpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*
canonical juju3.4 → 3.4.5nvdUScpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*
canonical juju3.5 → 3.5.3nvdUScpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*
Go github.com/juju/jujualle VersionenosvUSpkg:golang/github.com/juju/juju
Go github.com/juju/juju< 2.9.50osvUSpkg:golang/github.com/juju/juju
Go github.com/juju/juju3.0.0 → 3.1.9osvUSpkg:golang/github.com/juju/juju
Go github.com/juju/juju3.2.0 → 3.3.6osvUSpkg:golang/github.com/juju/juju
Go github.com/juju/juju3.4.0 → 3.4.5osvUSpkg:golang/github.com/juju/juju
Go github.com/juju/juju3.5.0 → 3.5.3osvUSpkg:golang/github.com/juju/juju

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-6vjm-54vp-mxhxJuju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm2024-08-05ghsa · osvUS
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.
GO-2024-3010CVE-2024-6984 in github.com/juju/juju2024-08-06vendor · osvUS
CVE-2024-6984 in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/juju/juju from v2.9.0 before v2.9.50, from v3.1.0 before v3.1.9, from v3.3.0 before v3.3.5, from v3.4.0 before v3.4.5, from v3.5.0 before v3.5.3.
GO-2024-3040Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju2024-08-06vendor · osvUS
Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/juju/juju before v2.9.50, from v3.0.0 before v3.1.9, from v3.2.0 before v3.3.6, from v3.4.0 before v3.4.5, from v3.5.0 before v3.5.3.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

veröffentlicht 2024-07-29geändert 2026-06-17

verwandt (943)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-47813US	—OT kritisch	62.5% (99th)	KEV	2025-07-10
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.
CVE-2024-29059US	—OT kritisch	98.6% (100th)	KEV	2024-03-23
.NET Framework Information Disclosure Vulnerability
CVE-2013-7331US	medium4.3OT kritisch	50.2% (99th)	KEV	2014-02-26
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostn…
CVE-2021-22145US	medium6.5	76.2% (100th)	Exploit	2021-07-21
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submi…
CVE-2025-62168US	high7.5	63.4% (99th)	Exploit	2025-10-17
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulne…

+938 weitere

Referenzen (10)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan