CVE-2025-7044 - Vulnerability Details - OpenCVE

An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://bugs.launchpad.net/maas/+bug/2115714

History

Wed, 03 Dec 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 03 Dec 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.
Title		Privilege Escalation in MAAS via Websocket Request Manipulation
Weaknesses		CWE-269
References		https://bugs.launchpad.net/maas/+bug/2115714
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2025-12-03T15:45:47.494Z

Updated: 2025-12-03T16:42:52.179Z

Reserved: 2025-07-03T08:57:34.048Z

Link: CVE-2025-7044

Vulnrichment

Updated: 2025-12-03T16:42:48.167Z

NVD

Status : Received

Published: 2025-12-03T16:16:00.450

Modified: 2025-12-03T16:16:00.450

Link: CVE-2025-7044

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7044", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2025-07-03T08:57:34.048Z", "datePublished": "2025-12-03T15:45:47.494Z", "dateUpdated": "2025-12-03T16:42:52.179Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://canonical.com/maas", "defaultStatus": "unaffected", "packageName": "maas", "platforms": ["Linux"], "product": "MAAS", "repo": "https://launchpad.net/maas", "vendor": "Ubuntu", "versions": [{"lessThan": "3.3.11", "status": "affected", "version": "3.3.0", "versionType": "semver"}, {"lessThan": "3.4.9", "status": "affected", "version": "3.4.0", "versionType": "semver"}, {"lessThan": "3.5.9", "status": "affected", "version": "3.5.0", "versionType": "semver"}, {"lessThan": "3.6.2", "status": "affected", "version": "3.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.8.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://bugs.launchpad.net/maas/+bug/2115714"}], "credits": [{"lang": "en", "value": "Jacopo Rota", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "title": "Privilege Escalation in MAAS via Websocket Request Manipulation", "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-12-03T15:45:47.494Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T16:41:56.792010Z", "id": "CVE-2025-7044", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T16:42:52.179Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7044", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T16:41:56.792010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T16:42:48.167Z"}}], "cna": {"title": "Privilege Escalation in MAAS via Websocket Request Manipulation", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jacopo Rota"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://launchpad.net/maas", "vendor": "Ubuntu", "product": "MAAS", "versions": [{"status": "affected", "version": "3.3.0", "lessThan": "3.3.11", "versionType": "semver"}, {"status": "affected", "version": "3.4.0", "lessThan": "3.4.9", "versionType": "semver"}, {"status": "affected", "version": "3.5.0", "lessThan": "3.5.9", "versionType": "semver"}, {"status": "affected", "version": "3.6.0", "lessThan": "3.6.2", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.8.0", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "maas", "collectionURL": "https://canonical.com/maas", "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/maas/+bug/2115714"}], "descriptions": [{"lang": "en", "value": "An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the is_superuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-12-03T15:45:47.494Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7044", "state": "PUBLISHED", "dateUpdated": "2025-12-03T16:42:52.179Z", "dateReserved": "2025-07-03T08:57:34.048Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2025-12-03T15:45:47.494Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}