CVE-2017-9232
highpriority · attend · 66OT risk · highEPSS 0.485 · 99 %ileexploit · weaponizedEUUSEPSS · scored 2026-10-27
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.8–10
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- exploit/linux/local/juju_run_agent_priv_escJuju-run Agent Privilege Escalationweaponized · metasploit
- EDB-44023Juju-run Agent - Privilege Escalation (Metasploit)functional · exploit_db
affected products (10)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-j3hp-pv6v-rgrxJuju uses a UNIX domain socket without setting appropriate permissions2022-05-13ghsa · osvUS
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
- GO-2025-3639Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju2025-04-24vendor · osvUS
Juju uses a UNIX domain socket without setting appropriate permissions in github.com/juju/juju
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://bugs.launchpad.net/juju/+bug/1682411cnnvd
- https://cxsecurity.com/issue/WLB-2018020142cnnvd
- https://jujucharms.com/Patchcnnvd
- https://www.exploit-db.com/exploits/44023/cnnvd
- https://www.securityfocus.com/bid/98737cnnvd
- http://www.securityfocus.com/bid/98737enisa_euvd
- https://bugs.launchpad.net/juju/+bug/1682411enisa_euvd
- https://www.exploit-db.com/exploits/44023/enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan