Описание
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | released | 5.0.30-1+deb9u1build0.18.04.1 |
| cosmic | released | 5.0.30-1+deb9u1build0.18.10.1 |
| devel | not-affected | 5.0.30-1.1 |
| disco | released | 5.0.30-1+deb9u1build0.19.04.1 |
| eoan | not-affected | 5.0.30-1.1 |
| esm-apps/bionic | released | 5.0.30-1+deb9u1build0.18.04.1 |
| esm-apps/focal | not-affected | 5.0.30-1.1 |
| esm-apps/jammy | not-affected | 5.0.30-1.1 |
| esm-apps/xenial | released | 5.0.27-2ubuntu0.1~esm1 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| artful | DNE | |
| bionic | DNE | |
| cosmic | DNE | |
| devel | DNE | |
| disco | DNE | |
| eoan | DNE | |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was needed] |
| esm-infra/focal | DNE | |
| focal | DNE | |
| groovy | DNE |
Показывать по
1.2 Low
CVSS2
4.7 Medium
CVSS3
Связанные уязвимости
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed ...
Уязвимость веб-сервера Phusion Passenger, связанная с возможностью создания символической ссылки между REVISION и произвольным файлом в системе, позволяющая нарушителю получить доступ к конфиденциальным данным
1.2 Low
CVSS2
4.7 Medium
CVSS3