PT-2019-14340 · Wtf · Wtf

Senorprogrammer · Published 2019-08-28 · Updated 2020-08-24 · CVE-2019-15716

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WTF versions prior to 0.19.0

Description The issue concerns the permissions of the config.yml file, which might be misconfigured or based on unsafe OS defaults, potentially allowing local attackers to read sensitive information such as passwords or API keys.

Recommendations For versions prior to 0.19.0, ensure the permissions of the config.yml file are properly set to prevent unauthorized access. As a temporary workaround, consider manually configuring the permissions of the config.yml file to restrict access until a fixed version is available.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-15716

Affected Products

Wtf

References · 5

• 🔥 https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72 · Exploit
• https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0 · Patch
• https://osv.dev/vulnerability/CVE-2019-15716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15716 · Security Note
• https://github.com/wtfutil/wtf/issues/517 · Note