CVE-2024-41637: RaspAP allows an attacker to escalate privileges
RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.
Published Jul 29, 2024 · Updated Aug 2, 2024
Affected packages
billz/raspap-webgui
- Ecosystem
- Composer (PHP)
- Affected
- <= 3.1.4
- Fixed in
- No patched version yet
- Check
composer show billz/raspap-webgui
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology