CVE-2017-2665CWE-522

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is…

Medium · published July 6, 2018

CVSS v3.0
4.8
EPSS
0%
Percentile
24.4
In the wild
Unconfirmed
What it is

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

The record
Technical detail
CVSS v3.0
4.8 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.4th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2018-07-06T13:00Z
EPSS history
Timeline
  • 06 JUL 13:00Z
    The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is…
    cvelistv5