CVE-2019-3870

MEDIUM Year: 2019
CVSS v3 Score
6.1
Medium
CVSS v2 Score
3.6
Low
Weakness Type
CWE-276
View all →

Vulnerability Description

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Related Vulnerabilities

CVE-2019-12752

MEDIUM
CVSS:6.1(Medium)

The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in ...

CWE-2762019

CVE-2021-33214

MEDIUM
CVSS:6.1(Medium)

In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or...

CWE-2762021

CVE-2023-38294

MEDIUM
CVSS:6.1(Medium)

Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory (versionCode='7', versionName='1.8.0(220...

CWE-2762023

CVE-2024-5321

MEDIUM
CVSS:6.1(Medium)

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container lo...

CWE-2762024

CVE-2022-36439

MEDIUM
CVSS:6.0(Medium)

AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the Temp directory and delete another more privileged file via S...

CWE-2762022

CVE-2023-29162

MEDIUM
CVSS:6.0(Medium)

Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation o...

CWE-2762023