7.7Yüksek
CVE-2025-7044Privilege Escalation in MAAS via Websocket Request Manipulation
Açıklama
An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.
Zayıflık türü (CWE):
CWE-269
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- https://bugs.launchpad.net/maas/+bug/2115714 Third Party Advisory
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:canonical:maas:*:*:*:*:*:*:*:*≥ 3.3.0 < 3.3.11cpe:2.3:a:canonical:maas:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.9cpe:2.3:a:canonical:maas:*:*:*:*:*:*:*:*≥ 3.5.0 < 3.5.9cpe:2.3:a:canonical:maas:*:*:*:*:*:*:*:*≥ 3.6.0 < 3.6.2