What is CVE-2024-41954?

CVE-2024-41954 is a medium-severity vulnerability in Fogproject, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 5.3/10. Published 2024-07-31.

How severe is CVE-2024-41954?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Fogproject

CVE-2024-41954

FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.

EPSS: 0.003 (23.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Fogproject — versions < 1.5.10.41

Weakness classification (CWE)

CWE-732 — Incorrect Permission Assignment for Critical Resource

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-41954?: CVE-2024-41954 is a medium-severity vulnerability in Fogproject, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 5.3/10. Published 2024-07-31.
How severe is CVE-2024-41954?: Medium severity. CVSS v3 base score is 5.3 out of 10.