CVE-2013-7458

LOW

Redis < 3.2.3 - Exposure of Sensitive Information via World-Readable .rediscli_history File

Title source: llm
STIX 2.1

Description

linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.

References (10)

Core 10
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/antirez/redis/pull/3322
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/antirez/redis/pull/1418
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html
Mailing List, Third Party Advisory x_refsource_confirm
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460
Patch, Third Party Advisory x_refsource_confirm
https://github.com/antirez/linenoise/issues/121
Patch, Third Party Advisory x_refsource_confirm
https://github.com/antirez/linenoise/pull/122
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3634
Patch, Third Party Advisory x_refsource_confirm
https://github.com/antirez/redis/issues/3284

Scores

CVSS v3 3.3
EPSS 0.0048
EPSS Percentile 38.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (2)
debian/debian_linux 8.0
redislabs/redis < 3.2.2
Published Aug 10, 2016
Tracked Since Feb 18, 2026