CVE-2016-6322

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for /etc/qci/answers, which allows local users to obtain the root password for the deployed system by reading the file.

Metrics

CVSS 3.0 8.4/10CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/92668Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1366413Issue Tracking, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/92668Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1366413Issue Tracking, Third Party Advisory, VDB Entry

Timeline

Published: Sep 22, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-63237.5The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on CVE-2016-63257.8The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/CVE-2016-63275.5drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer derefer CVE-2016-63288.1A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Serv CVE-2016-63295.9OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a lon CVE-2016-63309.8The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows CVE-2016-63317.5ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title re CVE-2016-63327.5MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers t CVE-2016-63336.1Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27 CVE-2016-63346.1Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and CVE-2016-63357.5MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which CVE-2016-63366.5MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypa