Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/9465?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9465?format=api", "vulnerability_id": "VCID-xn3j-fysa-ybga", "summary": "Incorrect Permission Assignment for Critical Resource\nAn Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.", "aliases": [ { "alias": "CVE-2018-12028" }, { "alias": "GHSA-jjhj-8gx7-x836" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/934478?format=api", "purl": "pkg:deb/debian/passenger@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/passenger@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/934479?format=api", "purl": "pkg:deb/debian/passenger@5.0.30-1.2%2Bdeb11u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-fhu6-3k8p-aub2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/passenger@5.0.30-1.2%252Bdeb11u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/934477?format=api", "purl": "pkg:deb/debian/passenger@6.0.17%2Bds-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/passenger@6.0.17%252Bds-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/934481?format=api", "purl": "pkg:deb/debian/passenger@6.0.26%2Bds-1.1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/passenger@6.0.26%252Bds-1.1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/934480?format=api", "purl": "pkg:deb/debian/passenger@6.1.1%2Bds-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/passenger@6.1.1%252Bds-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/76204?format=api", "purl": "pkg:ebuild/www-apache/passenger@5.3.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/www-apache/passenger@5.3.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/29114?format=api", "purl": "pkg:gem/passenger@5.3.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/passenger@5.3.2" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/29113?format=api", "purl": "pkg:gem/passenger@5.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a91w-ppku-ebfc" }, { "vulnerability": "VCID-e99s-zs31-c3cn" }, { "vulnerability": "VCID-etvv-bvc3-qyan" }, { "vulnerability": "VCID-xn3j-fysa-ybga" }, { "vulnerability": "VCID-z5g4-xxf6-vbbh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/passenger@5.3.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/173322?format=api", "purl": "pkg:gem/passenger@5.3.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-a91w-ppku-ebfc" }, { "vulnerability": "VCID-e99s-zs31-c3cn" }, { "vulnerability": "VCID-etvv-bvc3-qyan" }, { "vulnerability": "VCID-xn3j-fysa-ybga" }, { "vulnerability": "VCID-z5g4-xxf6-vbbh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/passenger@5.3.1" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-12028.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-12028.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-12028", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39075", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39049", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39069", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39106", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39094", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39079", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39023", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39105", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.39085", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00175", "scoring_system": "epss", "scoring_elements": "0.38897", "published_at": "2026-04-01T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-12028" }, { "reference_url": "https://blog.phusion.nl/passenger-5-3-2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://blog.phusion.nl/passenger-5-3-2" }, { "reference_url": "https://github.com/phusion/passenger", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/phusion/passenger" }, { "reference_url": "https://github.com/phusion/passenger/commit/1e7c82deb4901c438f583737d8c9f2aac264737c", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/phusion/passenger/commit/1e7c82deb4901c438f583737d8c9f2aac264737c" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12028.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2018-12028.yml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1592621", "reference_id": "1592621", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1592621" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12028", "reference_id": "CVE-2018-12028", "reference_type": "", "scores": [ { "value": "6.8", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:P/A:P" }, { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12028" }, { "reference_url": "https://github.com/advisories/GHSA-jjhj-8gx7-x836", "reference_id": "GHSA-jjhj-8gx7-x836", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jjhj-8gx7-x836" }, { "reference_url": "https://security.gentoo.org/glsa/201807-02", "reference_id": "GLSA-201807-02", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201807-02" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 732, "name": "Incorrect Permission Assignment for Critical Resource", "description": "The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 284, "name": "Improper Access Control", "description": "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor." } ], "exploits": [], "severity_range_score": "4.7 - 8.9", "exploitability": "0.5", "weighted_severity": "8.0", "risk_score": 4.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xn3j-fysa-ybga" }