CVE-2025-15480
Published: 09 April 2026
Summary
CVE-2025-15480 is a low-severity Exposure of Sensitive System Information Due to Uncleared Debug Information (CWE-1258) vulnerability in Canonical Ubuntu Desktop Provision. Its CVSS base score is 2.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-15480 is a vulnerability in Ubuntu's ubuntu-desktop-provision version 24.04.4 that leads to the leakage of sensitive user credentials during crash reporting. Upon installation failure, if a user submits a bug report to Launchpad, the tool could include the user's password hash in the attached logs. This issue is categorized under CWE-1258 and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), indicating critical severity due to high confidentiality and availability impacts.
The vulnerability can be exploited by any unauthenticated attacker with network access to Launchpad, requiring low attack complexity and no privileges or direct user interaction from the attacker's perspective. Exploitation relies on a victim encountering an installation failure and choosing to submit a bug report, after which the password hash becomes accessible in the logs. Successful exploitation allows attackers to obtain the victim's password hash, enabling potential further credential compromise.
Mitigation is addressed in the canonical/ubuntu-desktop-provision GitHub repository through pull requests #1399 and #1400, which resolve the credential leakage in crash logs. Security practitioners should ensure affected systems are updated to patched versions of ubuntu-desktop-provision.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209377
Vulnerability details
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exposure of password hashes in crash log files uploaded to Launchpad enables credential access via unsecured files.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely flaw remediation through patching ubuntu-desktop-provision to eliminate password hash leakage in crash logs.
Monitors systems specifically for unauthorized disclosure of sensitive information like password hashes in crash reports submitted to Launchpad.
Filters sensitive credentials such as password hashes from information output before transmission to external services like Launchpad bug reporting.