Read the docs
TI-2013-00267 Aliases CVE-2013-0337GHSA-9ph7-v5fx-qwxf

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable…

Priority LOW 37CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.

Why it matters now

EPSS 0.02223 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 51

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*up to 1.3.13VulnerableF5
cpe:2.3:a:f5:nginx:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableF5
cpe:2.3:a:f5:nginx:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableF5
cpe:2.3:a:f5:nginx:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableF5
cpe:2.3:a:f5:nginx:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableF5
cpe:2.3:a:f5:nginx:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableF5
cpe:2.3:a:f5:nginx:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableF5
cpe:2.3:a:f5:nginx:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableF5
cpe:2.3:a:f5:nginx:1.0.7:*:*:*:*:*:*:*1.0.7VulnerableF5
cpe:2.3:a:f5:nginx:1.0.8:*:*:*:*:*:*:*1.0.8VulnerableF5
  • cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* Versions up to 1.3.13 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.7:*:*:*:*:*:*:* Versions 1.0.7 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.8:*:*:*:*:*:*:* Versions 1.0.8 Vulnerable ·F5
Show 41 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx:1.0.9:*:*:*:*:*:*:*1.0.9VulnerableF5
cpe:2.3:a:f5:nginx:1.0.10:*:*:*:*:*:*:*1.0.10VulnerableF5
cpe:2.3:a:f5:nginx:1.0.11:*:*:*:*:*:*:*1.0.11VulnerableF5
cpe:2.3:a:f5:nginx:1.0.12:*:*:*:*:*:*:*1.0.12VulnerableF5
cpe:2.3:a:f5:nginx:1.0.13:*:*:*:*:*:*:*1.0.13VulnerableF5
cpe:2.3:a:f5:nginx:1.0.14:*:*:*:*:*:*:*1.0.14VulnerableF5
cpe:2.3:a:f5:nginx:1.0.15:*:*:*:*:*:*:*1.0.15VulnerableF5
cpe:2.3:a:f5:nginx:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableF5
cpe:2.3:a:f5:nginx:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableF5
cpe:2.3:a:f5:nginx:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableF5
cpe:2.3:a:f5:nginx:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableF5
cpe:2.3:a:f5:nginx:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableF5
cpe:2.3:a:f5:nginx:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableF5
cpe:2.3:a:f5:nginx:1.1.6:*:*:*:*:*:*:*1.1.6VulnerableF5
cpe:2.3:a:f5:nginx:1.1.7:*:*:*:*:*:*:*1.1.7VulnerableF5
cpe:2.3:a:f5:nginx:1.1.8:*:*:*:*:*:*:*1.1.8VulnerableF5
cpe:2.3:a:f5:nginx:1.1.9:*:*:*:*:*:*:*1.1.9VulnerableF5
cpe:2.3:a:f5:nginx:1.1.10:*:*:*:*:*:*:*1.1.10VulnerableF5
cpe:2.3:a:f5:nginx:1.1.11:*:*:*:*:*:*:*1.1.11VulnerableF5
cpe:2.3:a:f5:nginx:1.1.12:*:*:*:*:*:*:*1.1.12VulnerableF5
cpe:2.3:a:f5:nginx:1.1.13:*:*:*:*:*:*:*1.1.13VulnerableF5
cpe:2.3:a:f5:nginx:1.1.14:*:*:*:*:*:*:*1.1.14VulnerableF5
cpe:2.3:a:f5:nginx:1.1.15:*:*:*:*:*:*:*1.1.15VulnerableF5
cpe:2.3:a:f5:nginx:1.1.16:*:*:*:*:*:*:*1.1.16VulnerableF5
cpe:2.3:a:f5:nginx:1.1.17:*:*:*:*:*:*:*1.1.17VulnerableF5
cpe:2.3:a:f5:nginx:1.1.18:*:*:*:*:*:*:*1.1.18VulnerableF5
cpe:2.3:a:f5:nginx:1.1.19:*:*:*:*:*:*:*1.1.19VulnerableF5
cpe:2.3:a:f5:nginx:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableF5
cpe:2.3:a:f5:nginx:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableF5
cpe:2.3:a:f5:nginx:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableF5
cpe:2.3:a:f5:nginx:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableF5
cpe:2.3:a:f5:nginx:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableF5
cpe:2.3:a:f5:nginx:1.3.4:*:*:*:*:*:*:*1.3.4VulnerableF5
cpe:2.3:a:f5:nginx:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableF5
cpe:2.3:a:f5:nginx:1.3.6:*:*:*:*:*:*:*1.3.6VulnerableF5
cpe:2.3:a:f5:nginx:1.3.7:*:*:*:*:*:*:*1.3.7VulnerableF5
cpe:2.3:a:f5:nginx:1.3.8:*:*:*:*:*:*:*1.3.8VulnerableF5
cpe:2.3:a:f5:nginx:1.3.9:*:*:*:*:*:*:*1.3.9VulnerableF5
cpe:2.3:a:f5:nginx:1.3.10:*:*:*:*:*:*:*1.3.10VulnerableF5
cpe:2.3:a:f5:nginx:1.3.11:*:*:*:*:*:*:*1.3.11VulnerableF5
cpe:2.3:a:f5:nginx:1.3.12:*:*:*:*:*:*:*1.3.12VulnerableF5
  • cpe:2.3:a:f5:nginx:1.0.9:*:*:*:*:*:*:* Versions 1.0.9 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.10:*:*:*:*:*:*:* Versions 1.0.10 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.11:*:*:*:*:*:*:* Versions 1.0.11 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.12:*:*:*:*:*:*:* Versions 1.0.12 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.13:*:*:*:*:*:*:* Versions 1.0.13 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.14:*:*:*:*:*:*:* Versions 1.0.14 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.0.15:*:*:*:*:*:*:* Versions 1.0.15 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.7:*:*:*:*:*:*:* Versions 1.1.7 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.8:*:*:*:*:*:*:* Versions 1.1.8 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.9:*:*:*:*:*:*:* Versions 1.1.9 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.10:*:*:*:*:*:*:* Versions 1.1.10 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.11:*:*:*:*:*:*:* Versions 1.1.11 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.12:*:*:*:*:*:*:* Versions 1.1.12 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.13:*:*:*:*:*:*:* Versions 1.1.13 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.14:*:*:*:*:*:*:* Versions 1.1.14 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.15:*:*:*:*:*:*:* Versions 1.1.15 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.16:*:*:*:*:*:*:* Versions 1.1.16 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.17:*:*:*:*:*:*:* Versions 1.1.17 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.18:*:*:*:*:*:*:* Versions 1.1.18 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.1.19:*:*:*:*:*:*:* Versions 1.1.19 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.4:*:*:*:*:*:*:* Versions 1.3.4 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.6:*:*:*:*:*:*:* Versions 1.3.6 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.7:*:*:*:*:*:*:* Versions 1.3.7 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.8:*:*:*:*:*:*:* Versions 1.3.8 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.9:*:*:*:*:*:*:* Versions 1.3.9 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.10:*:*:*:*:*:*:* Versions 1.3.10 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.11:*:*:*:*:*:*:* Versions 1.3.11 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx:1.3.12:*:*:*:*:*:*:* Versions 1.3.12 Vulnerable ·F5

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0337
  2. 2026-10-03 Alias added: GHSA-9ph7-v5fx-qwxf

References

Advisory 1

Other 3

  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2013-01799 The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0… CVSS 2.0HIGH 7.5
  • TI-2016-00666 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to… CVSS 3.1HIGH 7.5
  • TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2009-02513 Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before… CVSS 2.0HIGH 7.5
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences