~ / search / GHSA-q623-2j2j-23jj

GHSA-q623-2j2j-23jj

RaspAP allows an attacker to escalate privileges

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-41637

Packages

EcosystemPackageAffectedFixed in
Packagist billz/raspap-webgui <= 3.1.4 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.

References

External links from the advisory. They lead to third-party sites.