Information Disclosure Through Insecure Defaults

2017-12-1917:55:46

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

25.3%

JSON

github.com/heketi/heketi is vulnerable to information disclosure through insecure defaults. The application by default sets the /etc/heketi/heketi.json as world readable, allowing a malicious user to access sensitive information contained in it such as passwords.

CPENameOperatorVersion
github.com/heketi/heketieqHEAD
github.com/heketi/heketilev10.3.0
heketieq4.0.0__9.el7rhgs
heketieq4.0.0__1.el7
heketieq2.0.6__1.el7rhgs
heketieq5.0.0__16.el7rhgs
heketieq1.0.2__1.el7rhgs
heketieq4.0.0__10.el7rhgs
heketieq4.0.0__7.el7rhgs
heketieq3.1.0__14.el7rhgs

Name	Operator	Version
github.com/heketi/heketi	eq	HEAD
github.com/heketi/heketi	le	v10.3.0
heketi	eq	4.0.0__9.el7rhgs
heketi	eq	4.0.0__1.el7
heketi	eq	2.0.6__1.el7rhgs
heketi	eq	5.0.0__16.el7rhgs
heketi	eq	1.0.2__1.el7rhgs
heketi	eq	4.0.0__10.el7rhgs
heketi	eq	4.0.0__7.el7rhgs
heketi	eq	3.1.0__14.el7rhgs