Vulnerabilities > CVE-2022-3287 - Files or Directories Accessible to External Parties vulnerability in Fwupd

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

fwupd

CWE-552

NVD

Published: 2022-09-28

Updated: 2023-11-07

Summary

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

Vulnerable Configurations

Part	Description	Count
Application	Fwupd Fwupd Fwupd - Fwupd Fwupd 0.1.0 Fwupd Fwupd 0.1.1 Fwupd Fwupd 0.1.2 Fwupd Fwupd 0.1.3 Fwupd Fwupd 0.1.4 Fwupd Fwupd 0.1.5 Fwupd Fwupd 0.1.6 Fwupd Fwupd 0.5.0 Fwupd Fwupd 0.5.1 Fwupd Fwupd 0.5.2 Fwupd Fwupd 0.5.3 Fwupd Fwupd 0.5.4 Fwupd Fwupd 0.6.0 Fwupd Fwupd 0.6.1 Fwupd Fwupd 0.6.2 Fwupd Fwupd 0.6.3 Fwupd Fwupd 0.7.0 Fwupd Fwupd 0.7.1 Fwupd Fwupd 0.7.2 Fwupd Fwupd 0.7.3 Fwupd Fwupd 0.7.4 Fwupd Fwupd 0.7.5 Fwupd Fwupd 0.8.0 Fwupd Fwupd 0.8.1 Fwupd Fwupd 0.8.2 Fwupd Fwupd 0.8.3 Fwupd Fwupd 0.9.1 Fwupd Fwupd 0.9.2 Fwupd Fwupd 0.9.3 Fwupd Fwupd 0.9.4 Fwupd Fwupd 0.9.5 Fwupd Fwupd 0.9.6 Fwupd Fwupd 0.9.7 Fwupd Fwupd 0.9.8 Fwupd Fwupd 0.9.9 Fwupd Fwupd 1.0.0 Fwupd Fwupd 1.0.1 Fwupd Fwupd 1.0.2 Fwupd Fwupd 1.0.3 Fwupd Fwupd 1.0.4 Fwupd Fwupd 1.0.5 Fwupd Fwupd 1.0.6 Fwupd Fwupd 1.0.7 Fwupd Fwupd 1.0.8 Fwupd Fwupd 1.0.9 Fwupd Fwupd 1.1.0 Fwupd Fwupd 1.1.1 Fwupd Fwupd 1.1.2 Fwupd Fwupd 1.1.3 Fwupd Fwupd 1.1.4 Fwupd Fwupd 1.2.0 Fwupd Fwupd 1.2.1 Fwupd Fwupd 1.2.2 Fwupd Fwupd 1.2.3 Fwupd Fwupd 1.2.4 Fwupd Fwupd 1.2.5 Fwupd Fwupd 1.2.6 Fwupd Fwupd 1.2.7 Fwupd Fwupd 1.2.8 Fwupd Fwupd 1.2.9 Fwupd Fwupd 1.2.10 Fwupd Fwupd 1.2.11 Fwupd Fwupd 1.2.12 Fwupd Fwupd 1.2.13 Fwupd Fwupd 1.2.14 Fwupd Fwupd 1.3.1 Fwupd Fwupd 1.3.2 Fwupd Fwupd 1.3.3 Fwupd Fwupd 1.3.4 Fwupd Fwupd 1.3.5 Fwupd Fwupd 1.3.6 Fwupd Fwupd 1.3.7 Fwupd Fwupd 1.3.8 Fwupd Fwupd 1.3.9 Fwupd Fwupd 1.3.10 Fwupd Fwupd 1.3.11 Fwupd Fwupd 1.3.12 Fwupd Fwupd 1.4.0 Fwupd Fwupd 1.4.1 Fwupd Fwupd 1.4.2 Fwupd Fwupd 1.4.3 Fwupd Fwupd 1.4.4 Fwupd Fwupd 1.4.5 Fwupd Fwupd 1.4.6 Fwupd Fwupd 1.4.7 Fwupd Fwupd 1.4.8 Fwupd Fwupd 1.5.0 Fwupd Fwupd 1.5.1 Fwupd Fwupd 1.5.2 Fwupd Fwupd 1.5.3 Fwupd Fwupd 1.5.4 Fwupd Fwupd 1.5.5 Fwupd Fwupd 1.5.6 Fwupd Fwupd 1.5.7 Fwupd Fwupd 1.5.8 Fwupd Fwupd 1.5.9 Fwupd Fwupd 1.5.10 Fwupd Fwupd 1.5.11 Fwupd Fwupd 1.5.12 Fwupd Fwupd 1.5.13 Fwupd Fwupd 1.6.0 Fwupd Fwupd 1.6.1 Fwupd Fwupd 1.6.2 Fwupd Fwupd 1.6.3 Fwupd Fwupd 1.6.4 Fwupd Fwupd 1.6.5 Fwupd Fwupd 1.7.0 Fwupd Fwupd 1.7.1 Fwupd Fwupd 1.7.2 Fwupd Fwupd 1.7.3 Fwupd Fwupd 1.7.4 Fwupd Fwupd 1.7.5 Fwupd Fwupd 1.7.6 Fwupd Fwupd 1.7.7 Fwupd Fwupd 1.7.8 Fwupd Fwupd 1.7.9 Fwupd Fwupd 1.7.10 Fwupd Fwupd 1.8.0 Fwupd Fwupd 1.8.1 Fwupd Fwupd 1.8.2 Fwupd Fwupd 1.8.3 Fwupd Fwupd 1.8.4	123

Common Weakness Enumeration (CWE)

CWE-552 - Files or Directories Accessible to External Parties

References

https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091