Vulnerability · Published Jul 31, 2024 · Assigned by GitHub_M
CVE-2024-41954FOG Weak file permissions
Medium 5.3
In plain English
A medium-severity incorrect permission assignment in fogproject from FOGProject. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FOGProject | fogproject | < 1.5.10.41 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L