PT-2024-37585 · Canonical+1 · Ubuntu Advantage Desktop Daemon+2

Marco Trevisan · CVE-2024-6388 · Published 2024-06-27 · Updated 2025-01-07

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubuntu Advantage Desktop Daemon versions prior to 1.12

Description The Ubuntu Advantage Desktop Daemon leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.

Recommendations For versions prior to 1.12, update to version 1.12 or later to resolve the issue.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-497

CWE-319

Related Identifiers

CVE-2024-6388

USN-7063-1

Affected Products

Linuxmint

Ubuntu

Ubuntu Advantage Desktop Daemon

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6388.json · Exploit
• https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24 · Patch
• https://osv.dev/vulnerability/USN-7063-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6388 · Security Note
• https://ubuntu.com/security/notices/USN-7063-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6388 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6388 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6388 · Security Note
• https://github.com/canonical/ubuntu-advantage-desktop-daemon · Note
• https://t.me/cvenotify/84693 · Telegram Post
• https://twitter.com/fluidattacks/status/1876745877915574782 · Twitter Post
• https://twitter.com/fluidattacks/status/1874872282188845269 · Twitter Post
• https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944 · Note