CVE-2014-1423 - CVE House
Back to Database
Status published Medium CVE-2014-1423

Online Accounts Signon daemon gives out all oauth tokens to any app

Vulnerability Description

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-1423

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Michael Zanetti

References

More from Ubuntu

View All →
CVE-2025-7044
Privilege Escalation in MAAS via Websocket Request Manipulation
High 7.7
CVE-2025-2486
UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu
Low 3.7
CVE-2023-0881
DDoS in Ubuntu package linux-bluefield
High 7.5
CVE-2022-1804
Accountsservice incorrectly drops privileges
Medium 5.5
CVE-2021-3939
Free of static data in accountsservice
High 7.8

Affected Vendor

Affected Software

signon
Vulnerable Versions:
Ubuntu 15.04 signon

Timeline

Official Publish: May 7th, 2020
Last Modified: September 16th, 2024
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-522

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation