CVE-2023-32698CWE-276

nfpm vulnerable to Incorrect Default Permissions

High · published May 30, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged

the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.3th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2023-05-30T03:56Z
EPSS history
Timeline
  • 30 MAY 03:56Z
    nfpm vulnerable to Incorrect Default Permissions
    cvelistv5