CVE-2018-12028 — Incorrect Permission Assignment in Passenger
Severity
7.8HIGHNVD
EPSS
0.2%
top 60.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 17
Latest updateMay 13
Description
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
4📋Vendor Advisories
2💬Community
1Bugzilla▶
CVE-2018-12028 passenger: Improper access control in SpawningKit can allow malicious child processes to kill arbitrary processes↗2018-06-19