CVE-2018-10869
19.07.2018, 22:29
redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | certification | - |
| redhat | enterprise_linux | 7.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-552 - Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
- CWE-732 - Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.