CVE-2015-1316
CVE-2015-1316 is a medium-severity vulnerability in Canonical Juju with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-320.
Key facts
- Severity: Medium (CVSS 3.x base score 6.4)
- CVSS v2: 5.0
- EPSS exploit prediction: 1% (63rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-320
- Affected product: Canonical Juju
- Published:
- Last modified:
Description
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
Frequently asked questions
- What is CVE-2015-1316?
- Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
- How severe is CVE-2015-1316?
- CVE-2015-1316 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2015-1316 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (63rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2015-1316?
- CVE-2015-1316 affects Canonical Juju. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2015-1316?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2015-1316 published?
- CVE-2015-1316 was published on 2019-04-22 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*
More vulnerabilities in Canonical Juju
- CVE-2026-4370 — Critical (CVSS 10.0): A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the…
- CVE-2026-5412 — Critical (CVSS 9.9): In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated…
- CVE-2017-9232 — Critical (CVSS 9.8): Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate…
- CVE-2026-32693 — High (CVSS 8.8): In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which…
- CVE-2025-0928 — High (CVSS 8.8): In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent…
- CVE-2025-53513 — High (CVSS 8.8): The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on…
All CVEs affecting Canonical Juju →
Other CWE-320 vulnerabilities
- CVE-2016-10467 — Critical (CVSS 9.8): In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD…
- CVE-2016-10421 — Critical (CVSS 9.8): In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206,…
- CVE-2018-0124 — Critical (CVSS 9.8): A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to…
- CVE-2015-0936 — Critical (CVSS 9.8): Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows…
- CVE-2015-4166 — Critical (CVSS 9.8): Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have…
- CVE-2024-36391 — Critical (CVSS 9.1): MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic