{"id":"CVE-2024-6388","aliases":["EUVD-2024-47495","GHSA-qr25-x8m6-w7qj","UBUNTU-CVE-2024-6388","USN-7063-1"],"status":"published","title":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks...","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00147,"percentile":0.03953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-319","CWE-497"],"published":"2024-06-27T00:00:00Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Ubuntu:20.04:LTS","package":"ubuntu-advantage-desktop-daemon","fixed_in":["1.10.ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ubuntu-advantage-desktop-daemon","fixed_in":["1.10.ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ubuntu-advantage-desktop-daemon","fixed_in":["1.11ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ubuntu-advantage-desktop-daemon","fixed_in":["1.10.ubuntu0.16.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ubuntu-advantage-desktop-daemon","fixed_in":["1.10.ubuntu0.18.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.ubuntu0.20.04.1"}]}],"versions":["1.10~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.ubuntu0.22.04.2"}]}],"versions":["1.0","1.3","1.3.1","1.4","1.4.1","1.5","1.6","1.7","1.8","1.9~22.04.1","1.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11ubuntu0.1"}]}],"versions":["1.10","1.10build1","1.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.ubuntu0.16.04.1~esm1"}]}],"versions":["1.10~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.ubuntu0.18.04.1~esm1"}]}],"versions":["1.10~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.ubuntu0.20.04.1"}]}],"versions":["1.10~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.ubuntu0.22.04.2"}]}],"versions":["1.0","1.3","1.3.1","1.4","1.4.1","1.5","1.6","1.7","1.8","1.9~22.04.1","1.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ubuntu-advantage-desktop-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11ubuntu0.1"}]}],"versions":["1.10","1.10build1","1.11"]}],"products":[{"vendor":"canonical","product":"ubuntu_advantage_desktop_daemon"},{"vendor":"canonical","product":"ubuntu_advantage_desktop_pro"},{"vendor":"canonical ltd.","product":"ubuntu advantage desktop pro"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944","tags":["issue-tracking","x_transferred","Issue Tracking","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6388","tags":["issue-tracking","x_transferred","Third Party Advisory","report"]},{"url":"https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24","tags":["issue-tracking","x_transferred","Issue Tracking","Patch","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6388","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qr25-x8m6-w7qj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6388.json","tags":["advisory"]},{"url":"https://github.com/canonical/ubuntu-advantage-desktop-daemon","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-6388","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7063-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-6388","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","status":"published","published":"2024-06-27T15:39:04.168Z","modified":"2024-08-01T21:41:03.306Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47495","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","status":"published","published":"2024-06-27T15:39:04Z","modified":"2024-08-01T21:41:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:32.736279Z"}],"ghsa":[{"id":"GHSA-qr25-x8m6-w7qj","title":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks...","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","status":"published","published":"2024-06-27T18:31:32Z","modified":"2025-08-27T18:31:50Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319","CWE-497"],"updated_at":"2026-11-02T15:03:25.515017Z"}],"nvd":[{"id":"CVE-2024-6388","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","status":"published","published":"2024-06-27T16:15:12.11Z","modified":"2026-06-17T08:17:55.007Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-497","CWE-319"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-6388","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","status":"published","published":"2024-06-27T15:39:04.168Z","modified":"2026-10-28T02:31:09.243045845Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"UBUNTU-CVE-2024-6388","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.","status":"published","published":"2024-06-27T00:00:00Z","modified":"2026-02-04T02:15:40.776261Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"USN-7063-1","title":"ubuntu-advantage-desktop-daemon vulnerability","description":"Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon leaked\nthe Pro token to unprivileged users by passing the token as an argument\nin plaintext. An attacker could use this issue to gain unauthorized access\nto an Ubuntu Pro subscription. (CVE-2024-6388)\n","status":"published","published":"2024-10-11T16:51:57Z","modified":"2026-06-25T13:32:29.154889671Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}