The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of th…

Published 7 y ago 2019-04-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.1

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.1%

percentile 66%

Public exploits

none known

The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.

Exploit prediction (EPSS)

1.10% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.1	`CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L`
CNA	3.0	7.1	`CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L`
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`

Affected products

Ubuntu snapweb

Classification

Weakness

CWE-284 Improper Access Control

References

github.com /snapcore/snapweb/commit/3f4cf9403f7687fbc8e27c0e01b2cf6aa5e7e0d5 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2016-1587
NVD: CVE-2016-1587

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.