Description

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Remediation

References

CVE-2013-4136

Related Vulnerabilities

WordPress Plugin WooCommerce Conversion Tracking Cross-Site Request Forgery (2.0.4)

MediaWiki Missing Authentication for Critical Function Vulnerability (CVE-2019-12468)

WordPress Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-8943)

WordPress Plugin WP Quick FrontEnd Editor Multiple Vulnerabilities (5.5)

WordPress Plugin Contact Form by BestWebSoft Cross-Site Scripting (3.51)

Severity

Medium

Classification

CVE-2013-4136 CWE-59

Tags

Missing Update Known Vulnerabilities