CVE-2021-45083

Katalog CVE

CVSS 7.1 · High EPSS 0,31%

Kerentanan Incorrect Default Permissions pada cobbler project cobbler, fedoraproject fedora. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

Rincian

Terbit di NVD

20 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openwall.com/lists/oss-security/2022/02/18/3 mailing list · mitigasi · patch · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=1193671 issue tracking · advisory pihak ketiga
• https://github.com/cobbler/cobbler/releases release notes · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEJN7CPW6YCHB...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVD...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DY...