{"id":"CVE-2013-0337","aliases":["DEBIAN-CVE-2013-0337","EUVD-2013-0349","GHSA-9ph7-v5fx-qwxf","UBUNTU-CVE-2013-0337"],"status":"published","title":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions...","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02223,"percentile":0.82798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2013-10-27T00:00:00Z","modified":"2026-11-05T19:01:03Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u10","1.22.1-9+deb12u2","1.22.1-9+deb12u3","1.22.1-9+deb12u4","1.22.1-9+deb12u5","1.22.1-9+deb12u6","1.22.1-9+deb12u7","1.22.1-9+deb12u8","1.22.1-9+deb12u9","1.24.0-1","1.24.0-1~exp1","1.24.0-2","1.26.0-1","1.26.0-1~exp1","1.26.0-2","1.26.0-3","1.26.2-1","1.26.3-1","1.26.3-2","1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4","1.26.3-3+deb13u5","1.26.3-3+deb13u6","1.26.3-3+deb13u7","1.26.3-3+deb13u8","1.26.3-3+deb13u9","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8","1.4.6-1ubuntu3.9+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6","1.10.3-0ubuntu0.16.04.5+esm7","1.10.3-0ubuntu0.16.04.5+esm9","1.10.3-0ubuntu0.16.04.5+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1","1.14.0-0ubuntu1.11+esm2","1.14.0-0ubuntu1.11+esm4","1.14.0-0ubuntu1.11+esm5"]}],"products":[{"vendor":"f5","product":"nginx"}],"references":[{"url":"http://secunia.com/advisories/55181","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/24/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/22/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://security.gentoo.org/glsa/glsa-201310-04.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/21/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0337"},{"url":"https://github.com/advisories/GHSA-9ph7-v5fx-qwxf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0337","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-0337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0337","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-0337","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2013-10-27T00:00:00Z","modified":"2024-08-06T14:25:09.144Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0349","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2013-10-27T00:00:00Z","modified":"2024-08-06T14:25:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-9ph7-v5fx-qwxf","title":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions...","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2022-05-05T02:48:49Z","modified":"2023-02-01T05:02:00Z","updated_at":"2026-11-02T14:49:49.102034Z"}],"nvd":[{"id":"CVE-2013-0337","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2013-10-27T00:55:03.713Z","modified":"2026-06-16T23:49:14.873Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"CVE-2013-0337","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2013-10-27T00:55:03Z","modified":"2026-04-10T03:42:39.856477Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0337","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2013-10-27T00:55:03.713Z","modified":"2026-10-21T14:00:28.189071285Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"UBUNTU-CVE-2013-0337","description":"The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.","status":"published","published":"2013-10-27T00:55:00Z","modified":"2026-11-05T19:01:03.426460854Z","updated_at":"2026-11-05T19:27:36.688147Z"}]}}