CVE-2015-1327

{"containers": {"cna": {"affected": [{"product": "Content Hub", "vendor": "Ubuntu", "versions": [{"lessThan": "0.0+15.04.20150331-0ubuntu1.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2015-06-03T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Missing access control checks.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-04-22T15:35:59.000Z", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212"}], "source": {"defect": ["https://bugs.launchpad.net/ubuntu/+source/content-hub/+bug/1456628"], "discovery": "UNKNOWN"}, "title": "Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2015-06-03T00:00:00.000Z", "ID": "CVE-2015-1327", "STATE": "PUBLIC", "TITLE": "Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Content Hub", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "0.0+15.04.20150331-0ubuntu1.0"}]}}]}, "vendor_name": "Ubuntu"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Missing access control checks."}]}]}, "references": {"reference_data": [{"name": "https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212", "refsource": "MISC", "url": "https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212"}]}, "source": {"defect": ["https://bugs.launchpad.net/ubuntu/+source/content-hub/+bug/1456628"], "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:40:18.580Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2015-1327", "datePublished": "2019-04-22T15:35:59.250Z", "dateReserved": "2015-01-22T00:00:00.000Z", "dateUpdated": "2024-09-16T17:27:40.688Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Content Hub", "vendor": "Ubuntu", "versions": [{"lessThan": "0.0+15.04.20150331-0ubuntu1.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*", "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app."}, {"lang": "es", "value": "Centro de contenido anterior a la versi\u00f3n 0.0 + 15.04.20150331-0ubuntu 1.0 DBUS API solo requiere un path de acceso de archivo para un elemento de contenido, en realidad no requiere que la aplicaci\u00f3n confinada tenga acceso al archivo para crear una transferencia. Esto podr\u00eda permitir que una aplicaci\u00f3n maliciosa utilizando la API DBUS para exportar file:///etc/passwd que luego enviar\u00eda una copia de ese archivo a otra aplicaci\u00f3n."}], "id": "CVE-2015-1327", "lastModified": "2026-06-17T00:22:12.070", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 0.3, "impactScore": 3.6, "source": "security@ubuntu.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-22T16:29:00.833", "references": [{"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}