CVEvulnerability
CVE-2019-15716
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-08-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-276
Description
WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.
Affected configurations
• wtfutil wtf (< 0.19.0)
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72 Exploit, Third Party Advisory
- https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0 Patch, Third Party Advisory
- https://github.com/wtfutil/wtf/issues/517 Third Party Advisory
- https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72 Exploit, Third Party Advisory
- https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0 Patch, Third Party Advisory
- https://github.com/wtfutil/wtf/issues/517 Third Party Advisory