{"id":"CVE-2015-3201","aliases":["EUVD-2015-3267","GHSA-785x-m7p9-vff9","RHSA-2015:1052"],"status":"published","title":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which...","description":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00507,"percentile":0.43534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-06-08T14:00:00Z","modified":"2026-06-29T10:09:15Z","fixes":[{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1","fixed_in":["0:2.0-60.9.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-apache-commons-fileupload","fixed_in":["0:1.3-60.7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-apache-commons-fileupload-javadoc","fixed_in":["0:1.3-60.7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jcommon","fixed_in":["0:1.0.18-60.5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jcommon-javadoc","fixed_in":["0:1.0.18-60.5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jcommon-xml","fixed_in":["0:1.0.18-60.5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jfreechart","fixed_in":["0:1.0.14-60.5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jfreechart-javadoc","fixed_in":["0:1.0.14-60.5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jline2","fixed_in":["0:2.10-60.6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jline2-javadoc","fixed_in":["0:2.10-60.6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-netty","fixed_in":["0:3.6.3-60.4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-netty-javadoc","fixed_in":["0:3.6.3-60.4.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-runtime","fixed_in":["0:2.0-60.9.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-scldevel","fixed_in":["0:2.0-60.9.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat","fixed_in":["0:1.2.0-60.10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat-debuginfo","fixed_in":["0:1.2.0-60.10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat-javadoc","fixed_in":["0:1.2.0-60.10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat-webapp","fixed_in":["0:1.2.0-60.10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1","fixed_in":["0:2.0-70.9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-apache-commons-fileupload","fixed_in":["0:1.3-70.3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-apache-commons-fileupload-javadoc","fixed_in":["0:1.3-70.3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jcommon","fixed_in":["0:1.0.18-70.5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jcommon-javadoc","fixed_in":["0:1.0.18-70.5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jcommon-xml","fixed_in":["0:1.0.18-70.5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jfreechart","fixed_in":["0:1.0.14-70.4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jfreechart-javadoc","fixed_in":["0:1.0.14-70.4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jline2","fixed_in":["0:2.10-70.3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jline2-javadoc","fixed_in":["0:2.10-70.3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-netty","fixed_in":["0:3.6.3-70.4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-netty-javadoc","fixed_in":["0:3.6.3-70.4.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-runtime","fixed_in":["0:2.0-70.9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-scldevel","fixed_in":["0:2.0-70.9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat","fixed_in":["0:1.2.0-70.12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat-debuginfo","fixed_in":["0:1.2.0-70.12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat-javadoc","fixed_in":["0:1.2.0-70.12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat-webapp","fixed_in":["0:1.2.0-70.12.el7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-60.9.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-60.7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-apache-commons-fileupload-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-60.7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jcommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.18-60.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jcommon-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.18-60.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jcommon-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.18-60.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jfreechart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.14-60.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jfreechart-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.14-60.5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jline2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10-60.6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-jline2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10-60.6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.3-60.4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-netty-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.3-60.4.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-60.9.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-60.9.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-60.10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-60.10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-60.10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"thermostat1-thermostat-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-60.10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-70.9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-70.3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-apache-commons-fileupload-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-70.3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jcommon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.18-70.5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jcommon-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.18-70.5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jcommon-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.18-70.5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jfreechart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.14-70.4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jfreechart-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.14-70.4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jline2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10-70.3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-jline2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10-70.3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.3-70.4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-netty-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.3-70.4.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-70.9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0-70.9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-70.12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-70.12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-70.12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"thermostat1-thermostat-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-70.12.el7"}]}]}],"products":[{"vendor":"redhat","product":"thermostat"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159788.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://icedtea.classpath.org/hg/thermostat/rev/c2f18f81f57a","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2372","tags":["x_refsource_CONFIRM","x_transferred","Exploit"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1052.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/75066","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159958.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3201","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1052","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221989","tags":["report"]},{"url":"https://github.com/advisories/GHSA-785x-m7p9-vff9"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1052.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3201","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-3201","description":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.","status":"published","published":"2015-06-08T14:00:00Z","modified":"2024-08-06T05:39:32.009Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3267","description":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.","status":"published","published":"2015-06-08T14:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-785x-m7p9-vff9","title":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which...","description":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.","status":"published","published":"2022-05-17T03:11:52Z","modified":"2023-02-10T05:06:54Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:54:03.327923Z"}],"nvd":[{"id":"CVE-2015-3201","description":"Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.","status":"published","published":"2015-06-08T14:59:10.35Z","modified":"2026-06-17T00:25:31.713Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"RHSA-2015:1052","title":"Red Hat Security Advisory: thermostat1 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T10:36:18Z","modified":"2026-06-29T10:09:15Z","updated_at":"2026-11-02T15:53:03.182161Z"}]}}