Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-d3tp-jggs-hug9
Vulnerability ID VCID-d3tp-jggs-hug9
Aliases CVE-2013-4136
GHSA-w6rc-q387-vpgq
OSV-94074
Summary Utils.cpp Temporary Directory Creation Symlink Local Privilege Escalation This package contains a flaw as the program creates temporary directories insecurely. It is possible for a local attacker to use a symlink attack against the Utils.cpp file to allow the attacker to gain elevated privileges.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE http://rhn.redhat.com/errata/RHSA-2013-1136.html
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2013-4136
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2013-4136
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2013-4136
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2013-4136
generic_textual MODERATE https://code.google.com/p/phusion-passenger/issues/detail?id=910
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-w6rc-q387-vpgq
generic_textual MODERATE https://github.com/advisories/GHSA-w6rc-q387-vpgq
generic_textual MODERATE https://github.com/phusion/passenger
generic_textual MODERATE https://github.com/phusion/passenger/blob/release-4.0.6/NEWS
generic_textual MODERATE https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-4136.yml
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2013-4136
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2013/07/16/6
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2013-1136.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4136.json
https://api.first.org/data/v1/epss?cve=CVE-2013-4136
https://code.google.com/p/phusion-passenger/issues/detail?id=910
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4136
https://github.com/advisories/GHSA-w6rc-q387-vpgq
https://github.com/phusion/passenger
https://github.com/phusion/passenger/blob/release-4.0.6/NEWS
https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-4136.yml
https://nvd.nist.gov/vuln/detail/CVE-2013-4136
http://www.openwall.com/lists/oss-security/2013/07/16/6
985633 https://bugzilla.redhat.com/show_bug.cgi?id=985633
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.1383
EPSS Score 0.00044
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:36:11.223429+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/passenger/CVE-2013-4136.yml 38.6.0