CVE-2014-0185

Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 06 May 2014, 10:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
medium
39/100
CVSS Score
7.2 HIGH
v2.0 (nvd)
EPSS Score
0.11% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

06 May 2014, 10:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.

CVSS Metrics

  • v2.0•HIGH•Score: 7.2AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.11%• Percentile: 29%

Techniques & Countermeasures

  • CWE-269•Improper Privilege Management

    The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Systems

  • Unknown•PHP

    ≥ 5.3.0, < 5.3.28 | ≥ 5.4.0, < 5.4.28 | ≥ 5.5.0, < 5.5.12

References (12)