Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-python-rtslibamazon-linux-ami-2-upgrade-python-rtslib-doc | Jan 27, 2021 | Jun 19, 2020 | |
| Centos_linux | — | centos-upgrade-python-rtslibcentos-upgrade-python-rtslib-doc | Dec 21, 2020 | Jun 19, 2020 |
| Debian | debian-upgrade-python-rtslib-fb | Jul 30, 2024 | Jun 19, 2020 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-python-rtslib | Feb 22, 2021 | Jun 19, 2020 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-python-rtslib | Jan 20, 2021 | Jun 19, 2020 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-python-rtslib | Nov 2, 2020 | Jun 19, 2020 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-python-rtslibhuawei-euleros-2_0_sp9-upgrade-python3-rtslib | Feb 8, 2021 | Jun 19, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-python-rtsliboracle-linux-upgrade-python-rtslib-doc | Dec 17, 2020 | Jun 19, 2020 |
| Redhat_linux | — | redhat-upgrade-python-rtslibredhat-upgrade-python-rtslib-doc | Dec 21, 2020 | Jun 19, 2020 |
| Suse | — | suse-upgrade-python-rtslib-fb-commonsuse-upgrade-python2-rtslib-fbsuse-upgrade-python3-rtslib-fb | Aug 8, 2020 | Jun 19, 2020 |
| Ubuntu | ubuntu-upgrade-python-rtslib-fb | Nov 19, 2024 | Jun 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub