Read the docs
TI-2023-05094 Aliases CVE-2023-5536GHSA-7w5c-q3c8-5c62

Incorrect default permissions in Canonical Ubuntu Server

Priority LOW 28CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password.

Why it matters now

EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

No affected products listed by the sources yet.

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*before 24.04VulnerableCanonical
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* Versions before 24.04 Vulnerable ·Canonical

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5536
  2. 2026-10-03 Alias added: GHSA-7w5c-q3c8-5c62

References

Advisory 4

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences