Access Restriction Bypass Affecting nginx package, versions *


low

Snyk CVSS

    Attack Complexity Low
NVD
CVSS v3 N/A  high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-NGINX-520162
  • published 27 Oct 2013
  • disclosed 27 Oct 2013

How to fix?

There is no fixed version for Debian:11 nginx.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nginx package and not the nginx package as distributed by Debian:11. See How to fix? for Debian:11 relevant fixed versions and status.

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.