CVE-2019-15716 | BDVDB-2026-121981 Detail

Description#

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0
https://github.com/wtfutil/wtf/issues/517
https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72

Exploit#

No public exploit known

History#

Version 12019-08-28Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.