CVE-2024-34477 Privilege escalation in n/a
Local attackers can gain root privileges by mounting a crafted NFS share with insecure options to execute arbitrary code as root.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-34477?
CVE-2024-34477 is a high-severity vulnerability in n/a, published on 27 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vulnerability, someone needs to mount an NFS share in order to add an executable file as root. In addition, the SUID bit must be added to this file.
Weakness: CWE-250
Which versions are affected by CVE-2024-34477?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2024-34477?
No fix has been published for CVE-2024-34477 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-34477 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34477 exists.
Other vulnerabilities in n/a
- CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a