PT-2013-2246 · Nginx+1 · Nginx+1

Alexey V. Vissarionov + 1 · Publicado 2013-10-27 · Atualizado 2021-11-10 · CVE-2013-0337

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.3.13 and earlier

Description The default configuration of nginx uses world-readable permissions for the access.log and error.log files. This allows local users to obtain sensitive information by reading these files.

Recommendations For versions 1.3.13 and earlier, consider changing the permissions of the access.log and error.log files to restrict read access to authorized users only.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-0337

ECHO-56F7-B9E3-0470

Produtos afetados

Debian

Nginx

Referências · 17

• http://openwall.com/lists/oss-security/2013/02/21/15 · Nota
• http://openwall.com/lists/oss-security/2013/02/24/1 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-0337 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201310-04.xml · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-0337 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0337 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0337 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-0337 · Nota de Segurança
• https://security.paloaltonetworks.com/PAN-SA-2020-0006 · Nota
• https://security-tracker.debian.org/tracker/source-package/nginx · Aviso do Fabricante
• http://secunia.com/advisories/55181 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-0337 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0337 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0337 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0337 · Nota de Segurança