CVE-2019-15716

Exploit

EPSS 0.05%
Published 28.08.2019 15:15:10
Last modified 21.11.2024 04:29:18
Source cve@mitre.org
Teams watchlist Login
Open Login

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Wtfutil ≫ Wtf Version < 0.19.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.05%	0.11

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72

Third Party Advisory

Exploit

https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0

Patch

Third Party Advisory

https://github.com/wtfutil/wtf/issues/517

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-15716

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-15716

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-15716

EUVD