Skip to content

Juju controller - Arbitrary file reading vulnerability

Moderate severity GitHub Reviewed Published Feb 15, 2023 in juju/juju • Updated Mar 22, 2023

Package

gomod github.com/juju/juju (Go)

Affected versions

>= 2.9.22, < 2.9.38
>= 3.0.0, < 3.0.3

Patched versions

2.9.38
3.0.3

Description

Impact

An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

Patches

Patched in juju 2.9.38 and juju 3.0.3
juju/juju#ef803e2

Workarounds

Limit read access to the controller model to only trusted users.

References

@wallyworld wallyworld published to juju/juju Feb 15, 2023
Published to the GitHub Advisory Database Mar 1, 2023
Reviewed Mar 1, 2023
Last updated Mar 22, 2023

Severity

Moderate
4.9
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CVE ID

CVE-2023-0092

GHSA ID

GHSA-x5rv-w9pm-8qp8

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.