{"id":"CVE-2013-4319","aliases":["DEBIAN-CVE-2013-4319","DSA-2770-1","EUVD-2013-4208","GHSA-h32j-52qf-p7w4","MGASA-2013-0308","UBUNTU-CVE-2013-4319"],"status":"published","title":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x,...","description":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.","severity":{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02915,"percentile":0.87103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-10-09T00:00:00Z","modified":"2026-06-16T23:57:01Z","fixes":[{"ecosystem":"Debian:6.0","package":"torque","fixed_in":["2.4.8+dfsg-9squeeze2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"torque","fixed_in":["2.4.16+dfsg-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"torque","fixed_in":["2.5.12-1.1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"torque","fixed_in":["4.1.5.1-1.1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"torque","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8+dfsg-9squeeze2"}]}],"versions":["2.4.8+dfsg-9","2.4.8+dfsg-9squeeze1"]},{"source":"osv","ecosystem":"Debian:7","package":"torque","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16+dfsg-1+deb7u1"}]}],"versions":["2.4.16+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:2","package":"torque","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.12-1.1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"torque","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5.1-1.1.mga3"}]}]}],"products":[{"vendor":"adaptivecomputing","product":"torque_resource_manager"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/09/09/11","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.debian.org/security/2013/dsa-2770","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.supercluster.org/pipermail/torqueusers/2013-September/016098.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/09/09/4","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4319"},{"url":"https://github.com/advisories/GHSA-h32j-52qf-p7w4"},{"url":"https://advisories.mageia.org/MGASA-2013-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4319","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4319","description":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.","status":"published","published":"2013-10-11T22:00:00Z","modified":"2024-08-06T16:38:01.983Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4208","description":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.","status":"published","published":"2013-10-11T22:00:00Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.70868Z"}],"ghsa":[{"id":"GHSA-h32j-52qf-p7w4","title":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x,...","description":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.","status":"published","published":"2022-05-17T05:00:36Z","modified":"2023-01-28T05:02:50Z","updated_at":"2026-11-02T14:43:51.142982Z"}],"nvd":[{"id":"CVE-2013-4319","description":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.","status":"published","published":"2013-10-11T22:55:40.067Z","modified":"2026-06-16T23:57:01.23Z","cvss":[{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:38.715467Z"}],"osv":[{"id":"DSA-2770-1","title":"torque - authentication bypass","status":"published","published":"2013-10-09T00:00:00Z","modified":"2026-03-09T01:20:49.377224Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0308","title":"Updated torque packages fix CVE-2013-4319","description":"Updated torque package fixes security vulnerability:\n\nA non-priviledged user who was able to run jobs or login to a node which ran\npbs_server or pbs_mom, could submit arbitrary jobs to a pbs_mom daemon to queue\nand run the job, which would run as root (CVE-2013-4319).\n","status":"published","published":"2013-10-17T19:03:34Z","modified":"2026-04-16T06:25:51.739341401Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-4319","description":"pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.","status":"withdrawn","published":"2013-10-11T22:55:00Z","modified":"2025-07-16T07:02:08.732877Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}