CVE-2013-7458 Information disclosure in n/a
Local attackers can read sensitive command history from Redis CLI due to world-readable file permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-7458?
CVE-2013-7458 is a low-severity vulnerability in Debian Debian Linux, published on 10 Aug 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.
Weakness: CWE-200
Which versions are affected by CVE-2013-7458?
It affects 2 products.
Linux distribution packages (2)
redis SUSE:Package Hub 12 | All versions | 3.0.7-6.1 |
redis SUSE:Package Hub 12 | All versions | 3.0.7-6.1 |
Products include Debian Debian Linux, Redislabs Redis.
How do I fix CVE-2013-7458?
Upgrade to a fixed version.
Is CVE-2013-7458 being exploited?
There is no known exploitation of CVE-2013-7458 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2013-7458, DLA-577-1, DSA-3634-1, GHSA-gfx7-7mf7-vcxx, MGASA-2016-0295, UBUNTU-CVE-2013-7458 and 2 more.