GitHub Advisoryadvisory · Packagist

GHSA-q623-2j2j-23jj RaspAP allows an attacker to escalate privileges

CRITICAL Published 2024-07-29 Modified 2024-07-29 Official page ↗
Aliases
CVE-2024-41637
Ecosystem
Packagist
Packages
billz/raspap-webgui
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-77
Reviewed
2024-07-29

Affected packages

• Packagist billz/raspap-webgui: <= 3.1.4 (no fix yet)

Description

RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.

Related

Alias · CVE (1)

  • CVE-2024-41637 RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References