PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0185)

Description

sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.

Remediation

References

CVE-2014-0185

Related Vulnerabilities

Moodle URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-10133)

WordPress Plugin Fileviewer Cross-Site Request Forgery (2.2)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8976)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23214)

WordPress Plugin jQuery Mega Menu Widget 'skin' Parameter Local File Include (1.0)

Severity

High

Classification

CVE-2014-0185 CWE-264