CVE-2019-15716

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72Exploit, Third Party Advisory
https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0Patch, Third Party Advisory
https://github.com/wtfutil/wtf/issues/517Third Party Advisory
https://github.com/wtfutil/wtf/blob/67658e172c9470e93e4122d6e2c90d01db12b0ac/cfg/config_files.go#L71-L72Exploit, Third Party Advisory
https://github.com/wtfutil/wtf/compare/v0.18.0...v0.19.0Patch, Third Party Advisory
https://github.com/wtfutil/wtf/issues/517Third Party Advisory

Timeline

Published: Aug 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-157179.8Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.CVE-2019-157184.4In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus CVE-2019-157198.0Altair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a message directly to pbs_mom, which fails t CVE-2019-15727.5PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.CVE-2019-157207.8CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modif CVE-2019-157215.4An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group m CVE-2019-157227.5An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdo CVE-2019-157235.3An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could CVE-2019-157246.1An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection CVE-2019-157257.5An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in d CVE-2019-157265.3An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be poin CVE-2019-157275.3An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied wh