CVE-2017-2665

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Jul 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26666.5It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjCVE-2017-26678.1Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable itCVE-2017-26686.5389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled.CVE-2017-26697.5Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the useCVE-2017-26707.5It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effecCVE-2017-26715.5The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannCVE-2017-26728.8A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log CVE-2017-26737.2An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federCVE-2017-26745.4JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sCVE-2017-26757.8Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. The vulnerability is rCVE-2017-26806.5Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment CVE-2017-26816.5Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service con
CVE-2017-2665: High severity, CVSS 7.0 | Vulnix