Description
Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.
References (6)
Core 6
Core References
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159788.html
Various Sources x_refsource_confirm
http://icedtea.classpath.org/hg/thermostat/rev/c2f18f81f57a
Exploit x_refsource_confirm
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2372
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-1052.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/75066
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159958.html
Scores
EPSS
0.0051
EPSS Percentile
39.6%
Details
CWE
CWE-200
Status
published
Products (1)
redhat/thermostat
< 1.4
Published
Jun 08, 2015
Tracked Since
Feb 18, 2026