LiveActive security incident?Get immediate response
CVE Record

CVE-2015-1327: Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access

Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.

LowCVSS 3.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A confined app could ask Ubuntu Content Hub to transfer a file by naming its path, even if the app was not allowed to read that file. The cited example involves copying a sensitive system file to another app. The issue is narrow and scored low, but it can expose confidential local data on affected systems.

Executive priority

Low priority for most organizations unless they operate affected Ubuntu Content Hub environments. Address through normal patch and platform hygiene, with faster action for managed devices that run third-party confined apps.

Technical view

Content Hub before 0.0+15.04.20150331-0ubuntu1.0 accepted file paths through its DBUS API without verifying the confined caller had file access. CVSS 3.0 is 3.9: physical access, high complexity, low privileges, user interaction required, high confidentiality impact, no integrity or availability impact.

Likely exposure

Exposure appears limited to Ubuntu Content Hub deployments running versions before 0.0+15.04.20150331-0ubuntu1.0, especially environments using confined apps and the Content Hub DBUS transfer API.

Exploitation context

The source bundle does not show active exploitation, KEV listing, or public weaponization. Exploitation requires local physical context, a malicious confined app, and user interaction according to the CVSS vector.

Researcher notes

The core issue is authorization bypass in transfer creation: path acceptance was not tied to caller file permissions. Evidence is limited to the CVE text and Launchpad revision reference; no CWE, exploit status, or detailed remediation advisory is included in the bundle.

Mitigation direction

  • Upgrade Ubuntu Content Hub to 0.0+15.04.20150331-0ubuntu1.0 or later where applicable.
  • Check Ubuntu or project guidance for supported fixed packages.
  • Limit installation and execution of untrusted confined apps on affected devices.
  • Review app confinement policies around Content Hub transfer capabilities.

Validation and detection

  • Inventory systems or images that include Ubuntu Content Hub.
  • Confirm installed Content Hub package versions against the fixed version threshold.
  • Review whether confined apps can access the Content Hub DBUS transfer API.
  • Check vendor advisories or package changelogs for the referenced Launchpad revision.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-1327 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.9 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.9CVSS 3.0LowCVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N0.33.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

3.9Low
CVSS 3.0 vector shape for CVE-2015-1327Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
UbuntuContent HubunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.