CVE-2024-28139

Summary

The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future.

Affected Software

Weaknesses

• CWE-250: CWE-250 Execution with Unnecessary Privileges

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2024/Dec/2

References

• https://r.sec-consult.com/imageaccess

• ←Previous
• Next→