CVE-2024-6107
Quick assessment
Affected
Canonical MAAS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Canonical MAAS是Canonical开源的一个用于大规模物理服务器管理和自动化部署的软件。 Canonical MAAS存在安全漏洞，该漏洞源于验证不足，可能导致攻击者绕过身份验证检查并运行RPC命令。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-6107
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Canonical MAAS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Canonical MAAS是Canonical开源的一个用于大规模物理服务器管理和自动化部署的软件。 Canonical MAAS存在安全漏洞，该漏洞源于验证不足，可能导致攻击者绕过身份验证检查并运行RPC命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2024-6107
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-6107
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: MAAS
-
CVE-2026-12392
RPC secret disclosure via vendor data endpoint in Canonical -
CVE-2025-7044
Privilege Escalation in MAAS via Websocket Request Manipulat -
CVE-2014-1426
get_file_by_name does not check owner -
CVE-2014-1427
MAAS API vulnerable to CSRF attack -
CVE-2014-1428
uuid.uuid1() is not suitable as an unguessable identifier/to
Same vendor: Canonical
-
CVE-2026-104055
Monitoring-user password logged in cleartext by postgres_exp -
CVE-2026-12392
RPC secret disclosure via vendor data endpoint in Canonical -
CVE-2026-102371
wsl-pro-service: Ubuntu Pro token exposed via process comman -
CVE-2026-87798
LXD client recursive file pull allows directory escape via m -
CVE-2026-87799
Arbitrary file write on LXD host via symlink in migration st
Same weakness: CWE-287
-
CVE-2026-97343
Burst Statistics <= 3.7.1 - Improper Authentication to Accou -
CVE-2026-104638
onetwothreeneth HospitalManagementSystem sessions.php improp -
CVE-2026-97637
JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypa -
CVE-2026-19660
Divi Membership <= 2.3.0 - Unauthenticated Authentication By -
CVE-2026-14378
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass
V. Comments for CVE-2024-6107
No comments yet