CVE-2013-4481
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions...
CVE-2013-4481 is a low vulnerability (CVSS 1.9) in Scientificlinux Luci, published November 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in luci 0:0.26.0-48.el6.
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
Exploit likelihood
What each source reports
NVD Score used
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
- Record
CVE-2013-4481- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
- Record
CVE-2013-4481- Updated
- 2026-11-02
EUVDEUVD-2013-4346 No score
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
- Record
EUVD-2013-4346- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ffhg-m72p-75j9 No score
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions...
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
- Record
GHSA-ffhg-m72p-75j9- Weakness
- CWE-362
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
luciRed Hat:enterprise_linux:6::server |
before 0:0.26.0-48.el6 | 0:0.26.0-48.el6 |
luci-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.26.0-48.el6 | 0:0.26.0-48.el6 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2013-1603.html
bugzilla.redhat.com/show_bug.cgi?id=988998
nvd.nist.gov/vuln/detail/CVE-2013-4481
github.com/advisories/GHSA-ffhg-m72p-75j9
access.redhat.com/errata/RHSA-2013:1603
Show 16 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1603.json
cve.org/CVERecord?id=CVE-2013-4481