CVE-2013-4481

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions...

1.9 LowFix available

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."

Exploit likelihood

0.25%Down 0.6 points since Feb 4, 2022

What each source reports

NVD Score used 1.9

Record: CVE-2013-4481
CVSS 2.0: 1.9 LowAV:L/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4481
Updated: 2026-11-02

EUVDEUVD-2013-4346 No score

Record: EUVD-2013-4346
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ffhg-m72p-75j9 No score

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions...

Record: GHSA-ffhg-m72p-75j9
Weakness: CWE-362
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`luci` Red Hat:enterprise_linux:6::server	before 0:0.26.0-48.el6	0:0.26.0-48.el6
`luci-debuginfo` Red Hat:enterprise_linux:6::server	before 0:0.26.0-48.el6	0:0.26.0-48.el6

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4481 is a low vulnerability (CVSS 1.9) in Scientificlinux Luci, published November 23, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in luci 0:0.26.0-48.el6.

References

Show 16 moreShow less