VULNERABILITY INTELLIGENCE

CVE-2018-14650

CVSS score5.9 MEDIUM
EPSS probability0.43%
CISA KEVNot currently listed
Published2018-09-27
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Description

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.

Weakness classification

  • CWE-276: Incorrect Default Permissions
  • CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references