CVE-2022-23952

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	keylime	keylime 6.3.0

References

https://github.com/keylime/keylime/commit/883085d6a4bcea3012729014d5b8e15ecd65fc7cPatch, Third Party Advisory
https://github.com/keylime/keylime/security/advisories/GHSA-fchm-5w2v-qfm8Third Party Advisory
https://seclists.org/oss-sec/2022/q1/101Exploit, Mailing List, Patch, Third Party Advisory
https://github.com/keylime/keylime/commit/883085d6a4bcea3012729014d5b8e15ecd65fc7cPatch, Third Party Advisory
https://github.com/keylime/keylime/security/advisories/GHSA-fchm-5w2v-qfm8Third Party Advisory
https://seclists.org/oss-sec/2022/q1/101Exploit, Mailing List, Patch, Third Party Advisory

Timeline

Published: Sep 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239535.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239545.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239555.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239565.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239575.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239585.5Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.CVE-2022-239599.1In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x befor CVE-2022-23965.4A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unk CVE-2022-239605.6Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can l CVE-2022-239616.1In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by CVE-2022-239687.5Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF fil CVE-2022-239708.1ASUS RT-AX56U’s update_json function has a path traversal vulnerability due to insufficient filtering for special characters in the URL para