CVE-2024-6107

CWE-287 — Improper Authentication4 documents4 sources
Severity
9.8CRITICAL
EPSS
0.1%
top 70.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Canonical MaasCanonical Metal AS A Service
Timeline
PublishedJul 21
Latest updateJul 23

Description

Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:HExploitability: 2.8 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5canonical/maas3.1.0 — 3.1.4+4
▶NVDcanonical/metal_as_a_service3.1.0 — 3.1.4+4

Patches

Patch: bugs.launchpad.net ↗

🔴Vulnerability Details

3
OSV
CVE-2024-6107: Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region↗2025-07-23
▶
GHSA
GHSA-525h-hfxr-w785: Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region↗2025-07-21
▶
CVEList
CVE-2024-6107: Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region↗2025-07-21
▶
CVE-2024-6107 (CRITICAL CVSS 9.8) | Due to insufficient verification | cvebase.io