CVE-2014-0135
Vulnerability from cvelistv5
Published
2014-05-08 14:00
Modified
2024-08-06 09:05
Severity ?
Summary
Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.
References
secalert@redhat.comhttp://theforeman.org/security.htmlVendor Advisory
Impacted products
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:05:38.996Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://theforeman.org/security.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-03-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-05-08T12:57:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://theforeman.org/security.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-0135",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://theforeman.org/security.html",
              "refsource": "CONFIRM",
              "url": "http://theforeman.org/security.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-0135",
    "datePublished": "2014-05-08T14:00:00",
    "dateReserved": "2013-12-03T00:00:00",
    "dateUpdated": "2024-08-06T09:05:38.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-0135\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2014-05-08T14:29:13.283\",\"lastModified\":\"2014-05-09T16:12:24.607\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local users to obtain passwords and other sensitive information by reading the file.\"},{\"lang\":\"es\",\"value\":\"Kafo anterior a 0.3.17 y 0.4.x anterior a 0.5.2, utilizado por Foreman, utiliza permisos de lectura universal para default_values.yaml, lo que permite a usuarios locales obtener contrase\u00f1as y otra informaci\u00f3n sensible mediante la lectura del archivo.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:P/I:N/A:N\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":1.9},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.4,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.3.16\",\"matchCriteriaId\":\"BEDA6869-9D6C-465A-AEA9-9BD807BB9CD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E06B70A9-926A-42C9-B32E-A1F5DDE70694\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C45AAA87-928A-44F4-BE0D-96C920073E92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D36C2690-6550-4540-A1B3-A404109BC3F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"15D37C7A-3EF5-4E95-9EBB-B639F0F3E5F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"582CDBEE-21CA-4828-95D4-F0C86C1E708C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8DBD26C-2B23-4003-AC6C-912752AD166F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B75554D2-A3C2-44A0-B1CC-2E838B8014A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F66CF6A-FF98-4F65-B60C-DC59777A8A8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A569A29-6ABF-4359-9508-B12EA6E89B30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B27CD1-5136-43D1-8A99-7E6FEC4BE700\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D54B8D65-E309-462F-BBA3-39724A29CC87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E800948-7659-430D-8AA1-037F45D69D2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26BD255A-FC21-4148-BACB-B7C5FA582047\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E98BEA7-E849-4D43-B9FC-FA57EC3248EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"146F8AFF-B014-4AF5-882F-B87FE6B1161F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"194DC2C9-F4B7-4EFA-84EF-401F8CA73654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D53BA71-3ECB-47B5-883F-1A81BF823E8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"523F795C-B841-4895-8915-5BBB7795DA74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C65F14E-BB16-4996-BB18-35E5718A36B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25EAF80A-87DA-41B5-8E3F-6BFB78677BF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"713E9773-35CF-4435-809A-06C5970E5261\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EDFA8BD-DEC6-4B97-AA5B-87B6ED237192\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA736CD3-8FBB-49C7-B564-40A4888821D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E91F250-1BD2-4A49-86E8-59FF4C134F7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ECB5FB7E-7C30-41B3-8CED-A8CD1B681856\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E45CE822-180D-48FA-B0D7-299C5EBBC066\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41AF2F1B-D25C-4E5C-B148-EADB8DD15092\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C23E6100-188D-4607-AAD2-95C96EDCAF23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1DAFC70-B034-4E10-A87F-46369EFACAF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"993E084A-8E6F-42DF-9550-07BB399D4319\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D476C3E-0149-4E9E-A2B1-8D37A2D8EA63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEBBD111-46E6-4BDB-A10C-F8D2EB2CD329\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8697FA5-CE88-4CF5-9BD6-6AA232CE4A3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF328E69-72DE-47A0-8834-55BE8F875229\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10ED8374-3BDC-489A-9F68-DF5DA3A7A332\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC480FE8-996F-4A61-BD49-B6A422777EA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.3.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F43CB8E-8F9E-45F7-8251-D8872C06F2D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6383C4B3-2105-4888-B30E-A5FDEACF9FA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDB29E10-A3AD-4A7D-B573-D581676542E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:theforeman:kafo:0.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9C36751-1EC7-47B1-ABDA-BA0D05292870\"}]}]}],\"references\":[{\"url\":\"http://theforeman.org/security.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.