Remote Code Execution Vulnerability in Snapweb Interface by Snapcore
CVE-2016-1587

7.5HIGH

Key Information:

Vendor

Ubuntu

Status
snapweb
Vendor
CVE Published:
22 April 2019

What is CVE-2016-1587?

The Snapweb interface before version 0.21.2 exposes critical controls that allow an attacker to install or remove snap packages without verifying the user's identity or the connection's origin. This vulnerability can be exploited to remotely introduce malicious snap packages from the Store, enabling unauthorized use of system resources and compromising the integrity of the system without the legitimate administrator's consent.

Affected Version(s)

snapweb < 0.21.2

References

https://github.com/snapcore/snapweb/commit/3f4cf9403f7687...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.