CVE-2024-41954

Katalog CVE

CVSS 7.8 · High EPSS 0,31%

Kerentanan Incorrect Permission Assignment for Critical Resource pada fogproject. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.

Rincian

Terbit di NVD

31 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FOGProject/fogproject/security/advisories/GHSA-pcqm-h8cx-282c exploit · advisory vendor
• https://github.com/FOGProject/fogproject/commit/97ed6d51608e52fc087ca1d2f03d6b8df612fc90 patch