{"api_version":"1","generated_at":"2026-07-23T03:38:09+00:00","cve":"CVE-2013-2007","urls":{"html":"https://cve.report/CVE-2013-2007","api":"https://cve.report/api/cve/CVE-2013-2007.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-2007","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-2007"},"summary":{"title":"CVE-2013-2007","description":"The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.","state":"PUBLISHED","assigner":"redhat","published_at":"2013-05-21 18:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.9","severity":"","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://osvdb.org/93032","name":"http://osvdb.org/93032","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.openwall.com/lists/oss-security/2013/05/06/5","name":"http://www.openwall.com/lists/oss-security/2013/05/06/5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Xen Security Advisory 51 (CVE-2013-2007) - qemu guest agent (qga)\n insecure file permissions","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84047","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84047","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/53325","name":"http://secunia.com/advisories/53325","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA53325 - Qemu Guest Agent Insecure Permissions Weakness - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00057.html","name":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00057.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2013:1202-1: moderate: qemu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=956082","name":"https://bugzilla.redhat.com/show_bug.cgi?id=956082","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 956082 – CVE-2013-2007 qemu: guest agent creates files with insecure permissions in deamon mode","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0791.html","name":"http://rhn.redhat.com/errata/RHSA-2013-0791.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67","name":"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"git.qemu.org Git - qemu.git/commit","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0896.html","name":"http://rhn.redhat.com/errata/RHSA-2013-0896.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/59675","name":"http://www.securityfocus.com/bid/59675","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1028521","name":"http://www.securitytracker.com/id/1028521","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Xen Qemu Guest Agent Insecure File Permissions Lets Local Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.qemu.org/?p=qemu.git;a=commit;h=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67","name":"CONFIRM:http://git.qemu.org/?p=qemu.git;a=commit;h=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67","refsource":"MITRE","tags":[],"title":"git.qemu.org Git - qemu.git/commit","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2007","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2007","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"2007","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"qemu","cpe5":"qemu","cpe6":"1.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T15:20:37.482Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"openSUSE-SU-2013:1202","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00057.html"},{"name":"93032","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/93032"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=956082"},{"name":"1028521","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1028521"},{"name":"59675","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/59675"},{"name":"[oss-security] 20130506 Xen Security Advisory 51 (CVE-2013-2007) - qemu guest agent (qga) insecure file permissions","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2013/05/06/5"},{"name":"53325","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/53325"},{"name":"qemu-cve20132007-priv-esc(84047)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84047"},{"name":"RHSA-2013:0791","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2013-0791.html"},{"name":"RHSA-2013:0896","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2013-0896.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-05-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"openSUSE-SU-2013:1202","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00057.html"},{"name":"93032","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/93032"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=956082"},{"name":"1028521","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1028521"},{"name":"59675","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/59675"},{"name":"[oss-security] 20130506 Xen Security Advisory 51 (CVE-2013-2007) - qemu guest agent (qga) insecure file permissions","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2013/05/06/5"},{"name":"53325","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/53325"},{"name":"qemu-cve20132007-priv-esc(84047)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/84047"},{"name":"RHSA-2013:0791","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2013-0791.html"},{"name":"RHSA-2013:0896","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2013-0896.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-2007","datePublished":"2013-05-21T18:00:00.000Z","dateReserved":"2013-02-19T00:00:00.000Z","dateUpdated":"2024-08-06T15:20:37.482Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-05-21 18:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:1.4.1:*:*:*:*:*:*:*","matchCriteriaId":"59B3B915-1606-48E4-9EFC-BD9D6A6D404A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"2007","Ordinal":"1","Title":"CVE-2013-2007","CVE":"CVE-2013-2007","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"2007","Ordinal":"1","NoteData":"The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.","Type":"Description","Title":"CVE-2013-2007"},{"CveYear":"2013","CveId":"2007","Ordinal":"2","NoteData":"2013-05-21","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"2007","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}