CVE-2024-41954

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jul 31, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-419555.4Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redireCVE-2024-419568.1Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repositorCVE-2024-419575.3Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the correspondingCVE-2024-419587.2mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authenticCVE-2024-419596.1mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload intCVE-2024-41969.8An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a speciaCVE-2024-419604.8mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload intCVE-2024-419619.6Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found inCVE-2024-419626.3Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set wCVE-2024-419648.1Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can onlyCVE-2024-419654.2Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask thCVE-2024-419678.1A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade