Insecure file permissions can result in confidential information leakage
In some cases, Kea log files or lease files may be world-readable.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-276 | CWE-276 Incorrect Default Permissions |
Type: CWE
Description: CWE-276 Incorrect Default Permissions
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 4.0 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Version: 3.1
Base score: 4.0
Base severity: MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Impacts
| CAPEC ID | Description |
|---|
| N/A | If an attacker has access to a local unprivileged user account, they would be able to read the logs and/or lease information. This might disclose details about DHCP clients (MAC addresses, hostnames, IP addresses, configuration details, and so on), or about Kea itself. |
CAPEC ID: N/A
Description: If an attacker has access to a local unprivileged user account, they would be able to read the logs and/or lease information. This might disclose details about DHCP clients (MAC addresses, hostnames, IP addresses, configuration details, and so on), or about Kea itself.