Project existence disclosure in LXD images API (Canonical LXD)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.39 % · percentile 33 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- canonical
- NVD status
- Analyzed
Description
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
Weaknesses (CWE)
- CWE-209 — Generation of Error Message Containing Sensitive Information
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | canonical |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security@ubuntu.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-xch9-h8qw-85c7 — Canonical LXD Project Existence Determination Through Error Handling in Image Get Function
- GO-2025-4005 — Canonical LXD Project Existence Determination Through Error Handling in Image Get Function in github.com/canonical/lxd
European references
- ENISA EUVD · EUVD-2025-32641
- GCVE · GCVE-0-2025-54291
Affected configurations (NVD CPE)
cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*≥ 4.0.0 < 5.21.4cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*≥ 6.1 < 6.5
Affected products
| Product | Versions |
|---|---|
| Canonical · LXD | affected 6.0 < 6.5 ; affected 5.21 < 5.21.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |