Back to Database
Status published
Medium
CVE-2013-2119
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for...
Vulnerability Description
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-2119
Credits & Attribution
No credits recorded in the NVD database.
References
More from phusion
View All →CVE-2018-12615
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion...
Medium
5.3
CVE-2018-12029
A race condition in the nginx module in Phusion Passenger...
High
7
CVE-2018-12028
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger...
High
7.8
CVE-2018-12027
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x...
High
8.8
CVE-2018-12026
During the spawning of a malicious Passenger-managed application, SpawningKit in...
Critical
9.8
Affected Vendor
phusion
View all reports →Affected Software
passenger, openshift
Vulnerable Versions:
0, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.17, 3.0.18, 3.0.19, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 1.0
Timeline
Official Publish:
January 2nd, 2014
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.