GitHub Advisoryadvisory · Go

GHSA-x5rv-w9pm-8qp8 Juju controller - Arbitrary file reading vulnerability

MEDIUM Published 2023-03-01 Modified 2025-02-07 Official page ↗
Aliases
CVE-2023-0092
Ecosystem
Go
Packages
github.com/juju/juju
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-73
Reviewed
2023-03-01

Affected packages

• Go github.com/juju/juju: >= 2.9.22, < 2.9.38 → fixed in 2.9.38 • Go github.com/juju/juju: >= 3.0.0, < 3.0.3 → fixed in 3.0.3

Description

Impact An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem. Patches Patched in juju 2.9.38 and juju 3.0.3 juju/juju#ef803e2 Workarounds Limit read access to the controller model to only trusted users.

Related

Alias · CVE (1)

  • CVE-2023-0092 An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-73 External Control of File Name or Path weakness

References