CVE-2020-12831

{"id": "CVE-2020-12831", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-05-13T18:15:12.047", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1830805", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/FRRouting/frr/pull/6383", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1830805", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/FRRouting/frr/pull/6383", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file"}, {"lang": "es", "value": "** EN DISPUTA ** Se detect\u00f3 un problema en FRRouting FRR (tambi\u00e9n se conoce como Free Range Routing) versiones hasta 7.3.1. Cuando se utiliza la funcionalidad split-config, crea un archivo de configuraci\u00f3n vac\u00edo con permisos predeterminados world-readable, conllevando a un posible filtrado de informaci\u00f3n por medio del archivo tools/frr.in y tools/frrcommon.sh.in. NOTA: algunos terceros consideran esto un error de usuario, no una vulnerabilidad, porque los permisos est\u00e1n bajo el control del usuario antes de que alguna informaci\u00f3n confidencial este presente en el archivo."}], "lastModified": "2024-11-21T05:00:21.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:free_range_routing:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3634E0FB-3635-4554-A95F-A09F45F29A0A", "versionEndIncluding": "7.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}