Read the docs
TI-2016-01447 Aliases CVE-2016-1587GHSA-7xcr-378w-qqg3

Improper access control in Ubuntu snapweb

Priority LOW 35CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.

Why it matters now

EPSS 0.01102 65th percentileScored 2026-11-07
Fix Fixed snapweb (Ubuntu): 0.21.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ubuntusnapwebbefore 0.21.20.21.2Patch availableCNA
  • snapweb VendorUbuntu Affected before 0.21.2 Fixed in 0.21.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snapweb:snapweb:*:*:*:*:*:*:*:*before 0.21.2VulnerableSnapweb
  • cpe:2.3:a:snapweb:snapweb:*:*:*:*:*:*:*:* Versions before 0.21.2 Vulnerable ·Snapweb

Remediation

  • Fix · CNA snapweb (Ubuntu) Fixed in 0.21.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-1587
  2. 2026-10-03 Alias added: GHSA-7xcr-378w-qqg3

References

Patch 1

  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2004-01032 Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and… CVSS 2.0HIGH 10.0
  • TI-2004-00896 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other… CVSS 2.0HIGH 10.0
  • TI-2004-00800 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may… CVSS 2.0HIGH 10.0
  • TI-2004-00962 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to… CVSS 2.0HIGH 10.0
See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences