CVE-2024-6388

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497 CWE-319

Affected software

Vendor	Product	Versions
Canonical Ltd.	Ubuntu Advantage Desktop Pro	< 1.12
canonical	ubuntu_advantage_desktop_pro	< 1.12

References

https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944Issue Tracking
https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24Issue Tracking, Patch
https://www.cve.org/CVERecord?id=CVE-2024-6388Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944Issue Tracking
https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24Issue Tracking, Patch
https://www.cve.org/CVERecord?id=CVE-2024-6388Third Party Advisory

Timeline

Published: Jun 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-63894.3An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2.CVE-2024-63905.9The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which coul CVE-2024-63916.4The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and in CVE-2024-63925.4The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing c CVE-2024-63934.8The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which co CVE-2024-63947.5A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concat CVE-2024-63955.3An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private rep CVE-2024-63969.8A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host serve CVE-2024-63979.8The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and CVE-2024-63985.3An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a cu CVE-2024-64007.5Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allow CVE-2024-64019.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL I