VDB
CVE-2013-3709
CVE-2013-3709
PUBLISHED
CVSS 7.199999809265137 HIGH
WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
EPSS 0.48% · 40.5th percentile
Risk Scores
CVSS 2.0
7.199999809265137
EPSS Score
0.48%
40.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| suse | studio_onsite | 1.3 |
| suse | webyast | 1.3 |
| n/a | n/a | n/a |
| novell | suse_lifecycle_management_server | 1.3 |
Timeline
- Dec 2, 2013 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- Jun 1, 2023 EPSS Score
References
- SUSE-SU-2014:0022 vendor-advisory
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb url
- SUSE-SU-2013:1894 vendor-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=851116 url
- openSUSE-SU-2013:1961 vendor-advisory
- openSUSE-SU-2013:1952 vendor-advisory
- openSUSE-SU-2013:1954 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2013-3709 advisory