GitHub Advisoryadvisory · Go

GHSA-2vp2-8m5j-4rjx cnlh nps vulnerable to file overwrite by local user

MEDIUM Published 2022-05-24 Modified 2025-04-17 Official page ↗
Aliases
CVE-2019-15119
Ecosystem
Go
Packages
ehang.io/nps
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-732
Reviewed
2025-04-17

Affected packages

• Go ehang.io/nps: < 0.23.2 → fixed in 0.23.2

Description

`lib/install/install.go` in cnlh nps prior to 0.23.2 uses 0777 permissions for `/usr/local/bin/nps and/or /usr/bin/nps`, leading to a file overwrite by a local user.

Related

Alias · CVE (1)

  • CVE-2019-15119 lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References