CVE-2014-1426 — Improper Input Validation in Maas

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGHNVD
CNA8.6
EPSS
0.5%
top 33.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ubuntu MaasCanonical Metal AS A Service
Timeline
PublishedApr 22
Latest updateMay 17

Description

A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS versions prior to 1.9.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5ubuntu/maasunspecified — 1.9.2
▶Ubuntuubuntu/maas< 1.9.5+bzr4599-0ubuntu1~14.04.1+1

🔴Vulnerability Details

3
GHSA
GHSA-8cwf-xm55-w837: A vulnerability in maasserver↗2022-05-17
▶
CVEList
get_file_by_name does not check owner↗2019-04-22
▶
OSV
CVE-2014-1426: A vulnerability in maasserver↗2019-04-22
▶
CVE-2014-1426 — Improper Input Validation in Maas | cvebase