CVE-2013-2119

Published: Jan 3, 2014Modified: Apr 29, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.

Affected (25)

Products: Phusion: Passenger · Redhat: Openshift

1 product

1 product

Configuration A

24 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Phusion Passenger	Up to 3.0.20
Phusion Passenger	Version 3.0.0
Phusion Passenger	Version 3.0.10
Phusion Passenger	Version 3.0.11
Phusion Passenger	Version 3.0.12
Phusion Passenger	Version 3.0.13
Phusion Passenger	Version 3.0.14
Phusion Passenger	Version 3.0.15
Phusion Passenger	Version 3.0.17
Phusion Passenger	Version 3.0.18
Phusion Passenger	Version 3.0.19
Phusion Passenger	Version 3.0.1
Phusion Passenger	Version 3.0.2
Phusion Passenger	Version 3.0.3
Phusion Passenger	Version 3.0.4
Phusion Passenger	Version 3.0.5
Phusion Passenger	Version 3.0.6
Phusion Passenger	Version 3.0.7
Phusion Passenger	Version 3.0.8
Phusion Passenger	Version 3.0.9
Phusion Passenger	Version 4.0.1
Phusion Passenger	Version 4.0.2
Phusion Passenger	Version 4.0.3
Phusion Passenger	Version 4.0.4