Description

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

Remediation

References

CVE-2013-4136

Related Vulnerabilities

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Cross-Site Scripting (5.7.11)

WordPress 4.9.x Multiple Vulnerabilities (4.9)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-27279)

WordPress Plugin Side Menu-add fixed side buttons SQL Injection (3.1.3)

WordPress Plugin PIKLIST-Rapid development framework Cross-Site Scripting (0.9.4.25)

Severity

Medium

Classification

CVE-2013-4136 CWE-59

Tags

Missing Update Known Vulnerabilities