Name: CVE-2015-1870: Exposure of Sensitive Information to an Unauthorized Actor
Creator: Rapid7
Published: 2017-06-26T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2015-1870, CWE-200, CVSS 5.5, EPSS 0.00101

The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.

CVSS Details

CVSS 3.0 Base Score: 5.5
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade libreportUpgrade libreport-centosUpgrade libreport-plugin-kerneloopsUpgrade abrt-gui-develUpgrade abrt-dbusUpgrade abrt-pythonUpgrade abrt-addon-ccppUpgrade libreport-plugin-mailxUpgrade libreport-webUpgrade abrt-cliUpgrade abrt-addon-pythonUpgrade abrt-libsUpgrade libreport-gtkUpgrade libreport-gtk-develUpgrade libreport-cliUpgrade abrt-python-docUpgrade abrt-addon-pstoreoopsUpgrade abrt-addon-xorgUpgrade abrt-desktopUpgrade abrt-guiUpgrade libreport-plugin-rhtsupportUpgrade abrt-addon-kerneloopsUpgrade abrt-develUpgrade libreport-web-develUpgrade libreport-plugin-reportuploaderUpgrade libreport-plugin-loggerUpgrade libreport-filesystemUpgrade libreport-newtUpgrade libreport-plugin-bugzillaUpgrade abrt-gui-libsUpgrade libreport-rhel-bugzillaUpgrade abrt-tuiUpgrade libreport-plugin-mantisbtUpgrade abrt-console-notificationUpgrade libreport-develUpgrade libreport-rhelUpgrade libreport-anacondaUpgrade libreport-plugin-ureportUpgrade libreport-compatUpgrade abrt-retrace-clientUpgrade abrt-addon-upload-watchUpgrade libreport-pythonUpgrade abrtUpgrade abrt-addon-vmcoreUpgrade libreport-rhel-anaconda-bugzilla	Aug 17, 2018	Jun 15, 2015
Oracle_linux	—	Upgrade abrt-dbusUpgrade abrt-gui-develUpgrade abrtUpgrade libreport-filesystemUpgrade abrt-addon-xorgUpgrade libreport-web-develUpgrade abrt-gui-libsUpgrade libreport-gtk-develUpgrade libreport-rhel-bugzillaUpgrade abrt-addon-kerneloopsUpgrade libreport-develUpgrade libreport-gtkUpgrade abrt-tuiUpgrade libreport-plugin-loggerUpgrade abrt-addon-vmcoreUpgrade abrt-cliUpgrade abrt-guiUpgrade abrt-addon-pythonUpgrade libreport-compatUpgrade abrt-pythonUpgrade libreport-plugin-mailxUpgrade libreport-newtUpgrade abrt-python-docUpgrade abrt-desktopUpgrade libreport-rhel-anaconda-bugzillaUpgrade libreport-anacondaUpgrade abrt-retrace-clientUpgrade abrt-addon-ccppUpgrade libreport-cliUpgrade abrt-addon-pstoreoopsUpgrade libreport-plugin-kerneloopsUpgrade libreport-pythonUpgrade libreportUpgrade libreport-webUpgrade libreport-plugin-reportuploaderUpgrade libreport-plugin-ureportUpgrade abrt-addon-upload-watchUpgrade abrt-console-notificationUpgrade libreport-plugin-bugzillaUpgrade abrt-libsUpgrade abrt-devel	Oct 16, 2024	Jun 26, 2017

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence