What’s Vulnerable › Vulnerabilities
CVE-2024-28139: Privilege escalation through sudo misconfiguration
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-12-11 · updated 2026-06-17
- Weakness: CWE-250
Description
The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future.
Affected products
- Image Access GmbH Scan2Net: through 7.42B
References
Get alerted when CVE-2024-28139 or the next vulnerability affects your stack