Description (CNA)
The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Canonical / Juju | affected 2.0.0 before 2.9.52; affected 3.0.0 before 3.6.8 |
CWE
CWE-24
References
ADP enrichment
No English description supplied.