Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-12615

19
FAUCET Score

CVE-2018-12615 is a medium-severity vulnerability affecting Phusion Passenger versions prior to 5.3.2. The flaw resides in the switchGroup() function, where incorrect handling of supplementary groups during privilege lowering could lead to an attacker gaining unintended permissions due to uninitialized memory. With a CVSS score of 5.3, this network-exploitable vulnerability has low integrity impact but no confidentiality or availability impact. There is currently no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal.

Impacted Technologies

VendorProductVersion(s)CPE
< 5.3.2CPE matchmatch criteria
cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

5.3MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.0

Exploit Intelligence

EPSS Score
1.20%
Probability of exploitation in next 30 days
EPSS Percentile
64.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0120 is in the 43rd percentile among its peer group of 23,701 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

github_advisorypatch availablevia nvd_reference
View patch
rubygemspatch availablevia ghsa
Product: passengerFixed in: 5.3.2
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 1.3Fixed in: ruby193-rubygem-passenger
redhatend of lifevia redhat_api
Product: Red Hat Ceph Storage 1.3Fixed in: rubygem-passenger

Vendor Advisories (2)

rubygemsGHSA-4284-jfhc-f854medium

Phusion Passenger incorrect permission assignment

May 13, 2022
redhatCVE-2018-12615Moderate

passenger: privilege lowering in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp

May 29, 2018

References

github.com / phusion/passenger/commit/4e97fdb86d0a0141ec9a052c6e691fcd07bb45c8
PatchThird Party Advisory