GitHub Advisoryadvisory · Go

GHSA-q9vw-wr57-xjv3 Information Exposure in Heketi

HIGH Published 2022-02-15 Modified 2023-02-03 Official page ↗
Aliases
CVE-2017-15104
Ecosystem
Go
Packages
github.com/heketi/heketi
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-552
Reviewed
2021-05-19

Affected packages

• Go github.com/heketi/heketi: < 5.0.1 → fixed in 5.0.1

Description

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

Related

Alias · CVE (1)

  • CVE-2017-15104 An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References