CVE-2013-0337

Original description

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.

Affected software

• nginx = 1.1.15= 1.1.17= 1.1.12= 1.0.1= 1.0.2= 1.1.19 exact match

Details

Published

2013-10-27

Last modified

2024-08-06

CVSS vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS (30-day exploit probability)

2.22% (percentile 83)

References

• cve.org/CVE-2013-0337
• nvd.nist.gov/vuln/detail/CVE-2013-0337
• secunia.com/advisories/55181
• www.openwall.com/lists/oss-security/2013/02/24/1
• www.openwall.com/lists/oss-security/2013/02/22/1
• security.gentoo.org/glsa/glsa-201310-04.xml
• www.openwall.com/lists/oss-security/2013/02/21/15