Ubuntu.comUB:CVE-2018-12027CVE-2018-12027
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
34.0%
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger
5.3.x before 5.3.2 causes information disclosure in the following
situation: given a Passenger-spawned application process that reports that
it listens on a certain Unix domain socket, if any of the parent
directories of said socket are writable by a normal user that is not the
application’s user, then that non-application user can swap that directory
with something else, resulting in traffic being redirected to a
non-application user’s process through an alternative Unix domain socket.
Notes
| Author | Note |
|---|---|
| rodrigo-zaiden | xenial, bionic, focal and impish have version 5.0.x and are not affected because the issue was introduced in 5.3.0, with a major overhaul in SpawningKit. |
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
34.0%