CVE-2014-0185
Published May 6, 2014
Last updated 2 years ago
Overview
- Description
- sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.2
- Impact score
- 10
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
- nvd@nist.gov
- CWE-269
Configurations
[ { "nodes": [ { "negate": false, "cpeMatch": [ { "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE5EC45B-7745-4ECE-82FC-478651A860C3", "versionEndExcluding": "5.3.28", "versionStartIncluding": "5.3.0" }, { "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EB84629-28BF-47C7-8D33-099344266DD9", "versionEndExcluding": "5.4.28", "versionStartIncluding": "5.4.0" }, { "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C4CDD11-8610-4107-910F-3364E3B2F1DF", "versionEndExcluding": "5.5.12", "versionStartIncluding": "5.5.0" } ], "operator": "OR" } ] } ]