GitHub Advisoryadvisory · Go

GHSA-3qc3-mx6x-267h Insecure default config access in WriteFreely

HIGH Published 2025-01-20 Modified 2025-01-21 Official page ↗

Aliases: CVE-2025-24337
Ecosystem: Go
Packages: github.com/writefreely/writefreely
Severity: High
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-281
Reviewed: 2025-01-21

Affected packages

• Go github.com/writefreely/writefreely: <= 0.15.1 (no fix yet)

Description

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.

Related

Alias · CVE (1)

CVE-2025-24337 WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini. vulnerability

Weakness · CWE (1)

CWE-281 Improper Preservation of Permissions weakness

References