{"id":"CVE-2012-5605","title":"Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions","summary":"A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This …","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-276"],"vendor":"Red Hat","product":"candlepin","affected":["candlepin (all versions)","gofer (all versions)","grinder (all versions)","katello (all versions)","katello-agent (all versions)","katello-certs-tools (all versions)","katello-cli (all versions)","katello-cli-tests (all versions)","katello-configure (all versions)","katello-selinux (all versions)","pulp (all versions)","quartz (all versions)","rubygem-apipie-rails (all versions)","gofer (all versions)","katello-agent (all versions)"],"published":"2013-01-04","updated":"2026-10-30","sourceUpdated":"2026-10-30T18:52:20.667Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2012-5605","references":[{"url":"http://osvdb.org/88141"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1543.html"},{"url":"http://secunia.com/advisories/51472"},{"url":"http://www.securityfocus.com/bid/56819"},{"url":"https://access.redhat.com/errata/RHSA-2012:1543","label":"RHSA-2012:1543"},{"url":"https://access.redhat.com/security/cve/CVE-2012-5605"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=828447"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882138"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80550"}],"tags":["cve.org"],"epss":0.00321,"epssPercentile":0.25277,"ingestedAt":"2026-11-05T16:24:31.394Z","slug":"CVE-2012-5605","body":"## Overview\n\nA flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows a local user to modify Grinder's cache files due to incorrect world-writable permissions set on the `/var/lib/pulp/cache/grinder/` directory. This could lead to unauthorized data tampering within the application's cache.\n\n## Affected\n\n- `candlepin (all versions)`\n- `gofer (all versions)`\n- `grinder (all versions)`\n- `katello (all versions)`\n- `katello-agent (all versions)`\n- `katello-certs-tools (all versions)`\n- `katello-cli (all versions)`\n- `katello-cli-tests (all versions)`\n- `katello-configure (all versions)`\n- `katello-selinux (all versions)`\n- `pulp (all versions)`\n- `quartz (all versions)`\n- `rubygem-apipie-rails (all versions)`\n- `gofer (all versions)`\n- `katello-agent (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}