CVE-2024-45339

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-45346.1The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as esCVE-2024-453408.8Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentiCVE-2024-453416.1A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificaCVE-2024-453468.8The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day InitiaCVE-2024-453479.6An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flaCVE-2024-453488.8Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of useCVE-2024-45358.8The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make loggCVE-2024-453517.8A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validatiCVE-2024-453528.8An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validationCVE-2024-453534.3An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper inpCVE-2024-453544.3A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and caCVE-2024-453555.5A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be expl
CVE-2024-45339: High severity, CVSS 7.1 | Vulnix