The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring…

Published 8 y ago 2018-07-06 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.8

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 26%

Public exploits

none known

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

Exploit prediction (EPSS)

0.33% probability of exploitation in the next 30 days, higher than 26% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	4.8	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L`
CNA	3.0	4.8	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L`
NVD	3.0	7.0	`CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	1.9	`AV:L/AC:M/Au:N/C:P/I:N/A:N`

Affected products

[UNKNOWN] rhscon-core

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

Technology feeds

MongoDB (RSS, critical only)

References

securityfocus.com /bid/97612 · vdb-entry, x_refsource_BID, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2665 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-2665
NVD: CVE-2017-2665

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.