description: When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
problem types: CWE-256 | CWE-552
affected:
{
product: fwupd
vendor: n/a
versions:
status: affected, version: Fixed in version 1.8.5
}