description: Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege.
problem types: CWE-532
affected:
{
packageName: subiquity
product: subiquity
vendor: Canonical Ltd.
repo: https://github.com/canonical/subiquity
platforms: Linux
versions:
status: affected, version: 0, lessThanOrEqual: 23.09.1, versionType: semver
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 5.5
baseSeverity: MEDIUM
]