CVE-2019-15716

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions…

published August 28, 2019

CVSS
—
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Published
2019-08-28T14:13Z
EPSS history
Timeline
  • 28 AUG 14:13Z
    WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions…
    cvelistv5