CVE-2018-12028

Description

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passengers process manager. If the malicious application then generates an error, it would cause Passengers process manager to kill said reported arbitrary PID.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.175

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2018-12026,CVE-2018-12028,CVE-2018-12027 are fixed in Ruby-passenger 5.3.2	Windows
Vulnerabilities CVE-2018-12026,CVE-2018-12028,CVE-2018-12027 are fixed in Ruby-passenger for Linux 5.3.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234