Moderate severityNVD Advisory· Published Oct 10, 2024· Updated Oct 10, 2024

CVE-2024-9312

Description

Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/ubuntu/authdGo	<= 0.0.0-20230706090440-d8cb2d561419	—

Affected products

Canonical (company)/Authdv5
Range: 0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-4gfw-wf7c-w6g2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-9312ghsaADVISORY
github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2ghsaissue-trackingWEB
www.cve.org/CVERecordghsaissue-trackingWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000