Maas

maas

Vendor: Canonical • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-7044 1Canonical 1Maas Jun 17, 2026 Dec 3, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to t...Show more An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.Show less
CVE-2013-1058 1Canonical 2Maas Ubuntu Linux Apr 29, 2026 Nov 23, 2013 N/A· v4 N/A· v3 5.8 MEDIUM· v2 maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.
CVE-2013-1057 1Canonical 2Maas Ubuntu Linux Apr 29, 2026 Nov 18, 2013 N/A· v4 N/A· v3 4.4 MEDIUM· v2 Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current working directory.