CVE-2024-28139

Description

The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future.

Reserved 2024-03-05 | Published 2024-12-11 | Updated 2024-12-12 | Assigner SEC-VLab

Problem types

CWE-250 Execution with Unnecessary Privileges

Product status

Default status
affected

Any version
affected

Credits

Daniel Hirschberger (SEC Consult Vulnerability Lab) finder

Tobias Niemann (SEC Consult Vulnerability Lab) finder

References

r.sec-consult.com/imageaccess third-party-advisory

cve.org (CVE-2024-28139)

nvd.nist.gov (CVE-2024-28139)

Download JSON