Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-2665

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

Published

2018-07-06T13:29:00.217

Last Modified

2024-11-21T03:23:56.060

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.8 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Access Vector: LOCAL
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

3.4

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-522
Type: Primary
CWE-522

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mongodb	mongodb	-	Yes
Application	redhat	storage_console	2.0	Yes

References

http://www.securityfocus.com/bid/97612 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2665 Issue Tracking, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/97612 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2665 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)