PT-2019-14340 · Wtf · Wtf

Senorprogrammer · Publicado 2019-08-28 · Atualizado 2020-08-24 · CVE-2019-15716

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WTF versions prior to 0.19.0

Description The issue concerns the permissions of the config.yml file, which might be misconfigured or based on unsafe OS defaults, potentially allowing local attackers to read sensitive information such as passwords or API keys.

Recommendations For versions prior to 0.19.0, ensure the permissions of the config.yml file are properly set to prevent unauthorized access. As a temporary workaround, consider manually configuring the permissions of the config.yml file to restrict access until a fixed version is available.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2019-15716

Produtos afetados

Wtf

Referências · 5

• 🔥 https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72 · Exploit
• https://github.com/wtfutil/wtf/issues/517 · Nota
• https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0 · Correção
• https://osv.dev/vulnerability/CVE-2019-15716 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15716 · Nota de Segurança