CVE-2020-13867

An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highest threat from this vulnerability is to confidentiality.

Mitigation

$ chmod -R og-rwx /etc/target

Future backup files will still be created with incorrect permissions, but attackers will not be able to access the target directory.