CVE-2015-3248
openhpi: world writable /var/lib/openhpi directory
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · February 10, 2014
Updated · May 13, 2026
Description
It was found that the "/var/lib/openhpi" directory provided by OpenHPI used world-writeable and world-readable permissions. A local user could use this flaw to view, modify, and delete OpenHPI-related data, or even fill up the storage device hosting the /var/lib directory.
Statement
This issue affects the version of openhpi as shipped with Red Hat Enterprise Linux 5 and 6. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5 and 6.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.6AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-552 · Files or Directories Accessible to External Parties