Nexpose reports "World writable files exist" vulnerability for some entries in /opt/weka/snaptool/

[agt-the-walker]

Hello,

Indeed on my hosts performing WEKA snapshots:

$ sudo find /opt/weka/snaptool -perm -02 -printf '%y %04m %p\n'
d 0777 /opt/weka/snaptool/logs
f 0666 /opt/weka/snaptool/logs/snaptool.log
f 0666 /opt/weka/snaptool/logs/snap_intent_q.log

The culprit appears to be https://github.com/weka/snaptool/blob/v1.6.2.1/background.py#L43.

IMHO permissions should be 0755 at most for directories and 0644 at most for files.

Thanks for your time. More details upon request.