Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Phusion Passenger nginx模块安全漏洞
Vulnerability Description
Phusion Passenger是荷兰Phusion公司的一个用于在Apache和Nginx网页服务器上部署Ruby on Rails项目的Apache模块。nginx module是其中的一个Nginx服务器模块。 Phusion Passenger 5.3.2版本至3.x版本（不包含5.3.2版本）中的nginx模块存在安全漏洞，该漏洞源于程序没有为所配置的非标准passenger_instance_registry_dir分配严格的权限。本地攻击者可通过在文件创建之后，用符号链接替换该文件利用该漏
CVSS Information
N/A
Vulnerability Type
N/A