PT-2013-2246 · Nginx+1 · Nginx+1

Alexey V. Vissarionov + 1 · Published 2013-10-27 · Updated 2021-11-10 · CVE-2013-0337

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nginx versions 1.3.13 and earlier

Description The default configuration of nginx uses world-readable permissions for the access.log and error.log files. This allows local users to obtain sensitive information by reading these files.

Recommendations For versions 1.3.13 and earlier, consider changing the permissions of the access.log and error.log files to restrict read access to authorized users only.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-0337

ECHO-56F7-B9E3-0470

Affected Products

Debian

Nginx

References · 17

• https://security-tracker.debian.org/tracker/CVE-2013-0337 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201310-04.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0337 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0337 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0337 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-0337 · Security Note
• https://security-tracker.debian.org/tracker/source-package/nginx · Vendor Advisory
• http://secunia.com/advisories/55181 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-0337 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0337 · Security Note
• http://openwall.com/lists/oss-security/2013/02/21/15 · Note
• http://openwall.com/lists/oss-security/2013/02/24/1 · Note
• https://security.paloaltonetworks.com/PAN-SA-2020-0006 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0337 · Note