CVE-2015-3201

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which...

2.1 LowFix available

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.

Exploit likelihood

0.51%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.

Record: CVE-2015-3201
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.

Record: CVE-2015-3201
Updated: 2026-11-02

EUVDEUVD-2015-3267 No score

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.

Record: EUVD-2015-3267
Updated: 2026-11-03

GitHub AdvisoriesGHSA-785x-m7p9-vff9 No score

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which...

Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.

Record: GHSA-785x-m7p9-vff9
Weakness: CWE-200
Updated: 2026-11-02

Affected products

redhat thermostat

Affected packages

Affected packages
Package	Affected	Fixed
`thermostat1` Red Hat:rhel_software_collections:2::el6	before 0:2.0-60.9.el6	0:2.0-60.9.el6
`thermostat1-apache-commons-fileupload` Red Hat:rhel_software_collections:2::el6	before 0:1.3-60.7.el6	0:1.3-60.7.el6
`thermostat1-apache-commons-fileupload-javadoc` Red Hat:rhel_software_collections:2::el6	before 0:1.3-60.7.el6	0:1.3-60.7.el6
`thermostat1-jcommon` Red Hat:rhel_software_collections:2::el6	before 0:1.0.18-60.5.el6	0:1.0.18-60.5.el6
`thermostat1-jcommon-javadoc` Red Hat:rhel_software_collections:2::el6	before 0:1.0.18-60.5.el6	0:1.0.18-60.5.el6
`thermostat1-jcommon-xml` Red Hat:rhel_software_collections:2::el6	before 0:1.0.18-60.5.el6	0:1.0.18-60.5.el6
`thermostat1-jfreechart` Red Hat:rhel_software_collections:2::el6	before 0:1.0.14-60.5.el6	0:1.0.14-60.5.el6
`thermostat1-jfreechart-javadoc` Red Hat:rhel_software_collections:2::el6	before 0:1.0.14-60.5.el6	0:1.0.14-60.5.el6
`thermostat1-jline2` Red Hat:rhel_software_collections:2::el6	before 0:2.10-60.6.el6	0:2.10-60.6.el6
`thermostat1-jline2-javadoc` Red Hat:rhel_software_collections:2::el6	before 0:2.10-60.6.el6	0:2.10-60.6.el6

Show 26 moreShow less

Affected packages
Package	Affected	Fixed
`thermostat1-netty` Red Hat:rhel_software_collections:2::el6	before 0:3.6.3-60.4.el6	0:3.6.3-60.4.el6
`thermostat1-netty-javadoc` Red Hat:rhel_software_collections:2::el6	before 0:3.6.3-60.4.el6	0:3.6.3-60.4.el6
`thermostat1-runtime` Red Hat:rhel_software_collections:2::el6	before 0:2.0-60.9.el6	0:2.0-60.9.el6
`thermostat1-scldevel` Red Hat:rhel_software_collections:2::el6	before 0:2.0-60.9.el6	0:2.0-60.9.el6
`thermostat1-thermostat` Red Hat:rhel_software_collections:2::el6	before 0:1.2.0-60.10.el6	0:1.2.0-60.10.el6
`thermostat1-thermostat-debuginfo` Red Hat:rhel_software_collections:2::el6	before 0:1.2.0-60.10.el6	0:1.2.0-60.10.el6
`thermostat1-thermostat-javadoc` Red Hat:rhel_software_collections:2::el6	before 0:1.2.0-60.10.el6	0:1.2.0-60.10.el6
`thermostat1-thermostat-webapp` Red Hat:rhel_software_collections:2::el6	before 0:1.2.0-60.10.el6	0:1.2.0-60.10.el6
`thermostat1` Red Hat:rhel_software_collections:2::el7	before 0:2.0-70.9.el7	0:2.0-70.9.el7
`thermostat1-apache-commons-fileupload` Red Hat:rhel_software_collections:2::el7	before 0:1.3-70.3.el7	0:1.3-70.3.el7
`thermostat1-apache-commons-fileupload-javadoc` Red Hat:rhel_software_collections:2::el7	before 0:1.3-70.3.el7	0:1.3-70.3.el7
`thermostat1-jcommon` Red Hat:rhel_software_collections:2::el7	before 0:1.0.18-70.5.el7	0:1.0.18-70.5.el7
`thermostat1-jcommon-javadoc` Red Hat:rhel_software_collections:2::el7	before 0:1.0.18-70.5.el7	0:1.0.18-70.5.el7
`thermostat1-jcommon-xml` Red Hat:rhel_software_collections:2::el7	before 0:1.0.18-70.5.el7	0:1.0.18-70.5.el7
`thermostat1-jfreechart` Red Hat:rhel_software_collections:2::el7	before 0:1.0.14-70.4.el7	0:1.0.14-70.4.el7
`thermostat1-jfreechart-javadoc` Red Hat:rhel_software_collections:2::el7	before 0:1.0.14-70.4.el7	0:1.0.14-70.4.el7
`thermostat1-jline2` Red Hat:rhel_software_collections:2::el7	before 0:2.10-70.3.el7	0:2.10-70.3.el7
`thermostat1-jline2-javadoc` Red Hat:rhel_software_collections:2::el7	before 0:2.10-70.3.el7	0:2.10-70.3.el7
`thermostat1-netty` Red Hat:rhel_software_collections:2::el7	before 0:3.6.3-70.4.el7	0:3.6.3-70.4.el7
`thermostat1-netty-javadoc` Red Hat:rhel_software_collections:2::el7	before 0:3.6.3-70.4.el7	0:3.6.3-70.4.el7
`thermostat1-runtime` Red Hat:rhel_software_collections:2::el7	before 0:2.0-70.9.el7	0:2.0-70.9.el7
`thermostat1-scldevel` Red Hat:rhel_software_collections:2::el7	before 0:2.0-70.9.el7	0:2.0-70.9.el7
`thermostat1-thermostat` Red Hat:rhel_software_collections:2::el7	before 0:1.2.0-70.12.el7	0:1.2.0-70.12.el7
`thermostat1-thermostat-debuginfo` Red Hat:rhel_software_collections:2::el7	before 0:1.2.0-70.12.el7	0:1.2.0-70.12.el7
`thermostat1-thermostat-javadoc` Red Hat:rhel_software_collections:2::el7	before 0:1.2.0-70.12.el7	0:1.2.0-70.12.el7
`thermostat1-thermostat-webapp` Red Hat:rhel_software_collections:2::el7	before 0:1.2.0-70.12.el7	0:1.2.0-70.12.el7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-3201 is a low vulnerability (CVSS 2.1) in Redhat Thermostat, published June 8, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in thermostat1 0:2.0-60.9.el6.

References

Show 8 moreShow less