NVD

Id
39450  
Name
CVE-2013-3709  
Description
WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2013-12-23  
Modified Date
2014-01-13  
Seq
2013-3709  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
201066 39450 CVE-2013-3709 SUSE-SU-2013:1894  View
201067 39450 CVE-2013-3709 openSUSE-SU-2013:1952  View
201068 39450 CVE-2013-3709 openSUSE-SU-2013:1954  View
201069 39450 CVE-2013-3709 openSUSE-SU-2013:1961  View
201070 39450 CVE-2013-3709 SUSE-SU-2014:0022  View
201071 39450 CVE-2013-3709 https://bugzilla.novell.com/show_bug.cgi?id=851116  View
201072 39450 CVE-2013-3709 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24134 JVNDB-2013-005709 WebYaST における権限を取得される脆弱性 WebYaST は、config/initializers/secret_token.rb に対して脆弱なパーミッションを使用するため、権限を取得される脆弱性が存在します。 CVE-2013-3709 63651 CVE-2013-3709 39450 7.2 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005709.html 2013-12-16 2013-12-25 View