linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade redis | Mar 31, 2017 | Jul 30, 2016 |
| Freebsd | — | Upgrade redisUpgrade redis-devel | Dec 10, 2025 | Oct 11, 2016 |
| Redislabs Redis | — | Upgrade RedisLabs Redis to the latest version | Aug 15, 2019 | Aug 10, 2016 |
| Suse | — | Upgrade redis | Aug 9, 2024 | Aug 10, 2016 |
| Ubuntu | — | Upgrade redis | Nov 19, 2024 | Aug 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub