CVE-2025-24337

Published: Jan 20, 2025Modified: Jun 17, 2026Deferred

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: MITRE (Secondary)

Description

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.

Related CWEs

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (3)

https://github.com/writefreely/writefreely/releases/tag/v0.15.1

Source: cve@mitre.org

https://raphus.social/@TV4Fun/113846757112643161

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2025/01/18/1

Source: cve@mitre.org

Timeline

No history available yet.