CVE-2024-7062 Local Privilege Escalation in Nimble Commander <= v1.6.0, Build 4087
Local attackers can escalate privileges to root via insufficient authorization checks in the privileged helper, allowing arbitrary system command execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7062?
CVE-2024-7062 is a high-severity vulnerability in Nimble Commander, published on 26 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as the root user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and terminating processes, among other operations.
Weakness: CWE-863
Which versions are affected by CVE-2024-7062?
It affects 1 product.
Products include Mikekazakov Nimble Commander.
How do I fix CVE-2024-7062?
No fix has been published for CVE-2024-7062 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7062 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7062 exists.