CVE-2024-6388
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks...
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Record
CVE-2024-6388- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-497
- Updated
- 2026-11-02
EUVDEUVD-2024-47495
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Record
EUVD-2024-47495- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qr25-x8m6-w7qj
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks...
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Record
GHSA-qr25-x8m6-w7qj- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-319, CWE-497
- Updated
- 2026-11-02
NVD
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Record
CVE-2024-6388- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-497, CWE-319
- Updated
- 2026-11-02
OSV
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Record
CVE-2024-6388- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-497
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-6388
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
- Record
UBUNTU-CVE-2024-6388- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-7063-1 No score
ubuntu-advantage-desktop-daemon vulnerability
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon leaked the Pro token to unprivileged users by passing the token as an argument in plaintext. An attacker could use this issue to gain unauthorized access to an Ubuntu Pro subscription. (CVE-2024-6388)
- Record
USN-7063-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ubuntu-advantage-desktop-daemonUbuntu:20.04:LTS |
before 1.10.ubuntu0.20.04.1, plus listed versions 1.10~20.04.1 |
1.10.ubuntu0.20.04.1 |
ubuntu-advantage-desktop-daemonUbuntu:22.04:LTS |
before 1.10.ubuntu0.22.04.2, plus listed versions 1.01.31.3.11.41.4.1 Show 6 moreShow less1.51.61.71.81.9~22.04.11.10~22.04.1 |
1.10.ubuntu0.22.04.2 |
ubuntu-advantage-desktop-daemonUbuntu:24.04:LTS |
before 1.11ubuntu0.1, plus listed versions 1.101.10build11.11 |
1.11ubuntu0.1 |
ubuntu-advantage-desktop-daemonUbuntu:Pro:16.04:LTS |
before 1.10.ubuntu0.16.04.1~esm1, plus listed versions 1.10~16.04.1 |
1.10.ubuntu0.16.04.1~esm1 |
ubuntu-advantage-desktop-daemonUbuntu:Pro:18.04:LTS |
before 1.10.ubuntu0.18.04.1~esm1, plus listed versions 1.10~18.04.1 |
1.10.ubuntu0.18.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6388 is a medium vulnerability (CVSS 5.9) in Canonical Ubuntu Advantage Desktop Daemon, published June 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 3rd percentile. Fixed in ubuntu-advantage-desktop-daemon 1.10.ubuntu0.20.04.1.
References
bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944
cve.org/CVERecord?id=CVE-2024-6388
github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24
nvd.nist.gov/vuln/detail/CVE-2024-6388
ubuntu.com/security/CVE-2024-6388