CVE-2024-39934

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
n/an/an/a
robotmkrobotmk< 2.0.1

References

Timeline

Published
Jul 4, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-399358.8jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificatCVE-2024-399365.9An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6CVE-2024-399377.5supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.CVE-2024-39945.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutCVE-2024-399438.8rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if CVE-2024-399447.5A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, caCVE-2024-399454.9A vulnerability has been found in Dahua products.  After obtaining the administrator's username and password, the attacker can send a carefuCVE-2024-399467.2A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefullCVE-2024-399476.5A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefullCVE-2024-399487.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cCVE-2024-399497.5A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, cCVE-2024-39952.0In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.