← Back

CVE-2021-24031

nvd nist
Published: Mar 4, 2021Modified: Nov 21, 2024

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.

Affected (1)

Products: Facebook: Zstandard
Facebook
1 product
Zstandard
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Zstandard
Before 1.4.1

Related CWEs

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
CWE-277
Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.

References (6)

Source: cve-assign@fb.com
ExploitIssue TrackingMailing ListThird Party Advisory
Source: cve-assign@fb.com
ExploitIssue TrackingThird Party Advisory
Source: cve-assign@fb.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.