CVE-2024-39916

Katalog CVE

CVSS 6.4 · Medium EPSS 0,29%

Kerentanan Insecure Default Variable Initialization pada fogproject. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.

Rincian

Terbit di NVD

12 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-453: Insecure Default Variable Initialization
CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88 patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjh advisory pihak ketiga