Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml
Date: 2022-05
Affected: rubygems/kafo, rubygems/kafo
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2014-0135

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for `default_values.yaml`, which allows local users to obtain passwords and other sensitive information by reading the file.


Mitigations:

Architectural layers (MAESTRO):