CVE-2023-32303CWE-732

Planet's secret file is created with excessive permissions

Medium · published May 12, 2023

CVSS v3.1
5.2
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2023-05-12T20:55Z
EPSS history
Timeline
  • 12 MAY 20:55Z
    Planet's secret file is created with excessive permissions
    cvelistv5