cnlh/nps · Security
cnlh nps vulnerable to file overwrite by local user
- GHSA ID
- GHSA-2vp2-8m5j-4rjx
- CVE ID
- CVE-2019-15119
- Severity
- medium
- Published
- Updated
- CVSS
- 5.5 · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS v3
- 5.5 · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Description
lib/install/install.go in cnlh nps prior to 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
CWEs
- CWE-732 · Incorrect Permission Assignment for Critical Resource