CVE-2019-15716 - WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults

Back Back to CVE browser

MEDIUM

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults

Published Aug 28, 2019

5.5

MEDIUM

CVSS 3.0

EPSS 0.46%

Description

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6652
Advisory
https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72
x_refsource_MISCExploitThird Party Advisory
https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0
x_refsource_MISCPatchThird Party Advisory
https://github.com/wtfutil/wtf/issues/517
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6652		Advisory
https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72		x_refsource_MISCExploitThird Party Advisory
https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0		x_refsource_MISCPatchThird Party Advisory
https://github.com/wtfutil/wtf/issues/517		x_refsource_MISCThird Party Advisory