CVE-2013-3709: Novell Suse Lifecycle Management Server

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.

Affected products

• Novell Suse Lifecycle Management Server: version 1.3 only
• Suse Studio Onsite: version 1.3 only
• Suse Webyast: version 1.3 only

Published 2013-12-23. Last modified 2026-06-16.