« Volver al listado

CVE-2024-41954

Estado: AnalizadaAlta (7.8)—

FOG es un sistema de gestión de inventario, clonación, imágenes, suite de rescate. La aplicación almacena las credenciales de la cuenta de servicio en texto plano en el archivo "/opt/fog/.fogsettings". Este archivo es legible de forma predeterminada por todos los usuarios del host. Al explotar estas credenciales, un usuario malintencionado podría crear nuevas cuentas para la aplicación web y mucho más. La vulnerabilidad se solucionó en 1.5.10.41.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fogproject — Fogproject

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41954",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41954",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-31T20:29:06.125619Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "FOGProject",
          "product": "fogproject",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.5.10.41"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*"
          ],
          "vendor": "fogproject",
          "product": "fogproject",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.5.10.41",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-31T20:15:06.587",
  "references": [
    {
      "url": "https://github.com/FOGProject/fogproject/commit/97ed6d51608e52fc087ca1d2f03d6b8df612fc90",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-pcqm-h8cx-282c",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the \"/opt/fog/.fogsettings\" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41."
    },
    {
      "lang": "es",
      "value": "FOG es un sistema de gestión de inventario, clonación, imágenes, suite de rescate. La aplicación almacena las credenciales de la cuenta de servicio en texto plano en el archivo \"/opt/fog/.fogsettings\". Este archivo es legible de forma predeterminada por todos los usuarios del host. Al explotar estas credenciales, un usuario malintencionado podría crear nuevas cuentas para la aplicación web y mucho más. La vulnerabilidad se solucionó en 1.5.10.41."
    }
  ],
  "lastModified": "2026-06-17T07:48:31.287",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDC1FAD4-EE15-41FF-BDF0-685E7885E4F6",
              "versionEndIncluding": "1.5.10.41",
              "versionStartIncluding": "1.5.10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}