CVE-2024-7558

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-337 CWE-340 CWE-1391 CWE-330 CWE-335

Affected software

Vendor	Product	Versions
Canonical Ltd.	Juju	>= 3.5, < 3.5.4; >= 3.4, < 3.4.6; >= 3.3, < 3.3.7; >= 3.1, < 3.1.10; >= 2.9, < 2.9.51

References

https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4Exploit, Patch, Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-7558Third Party Advisory

Timeline

Published: Oct 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-75598.8The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks CVE-2024-75607.2The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of CVE-2024-75618.8The The Next theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of un CVE-2024-75627.3A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom a CVE-2024-75646.5Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disc CVE-2024-75657.8SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2024-75676.9A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploit CVE-2024-75688.1The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to CVE-2024-75699.8An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated at CVE-2024-75708.1Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM p CVE-2024-75717.8Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.CVE-2024-75727.1Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.