critical9.9
CVE-2024-41637
RaspAP allows an attacker to escalate privileges
Impact
RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possesses Sudo privileges to execute several critical commands without a password.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | billz/raspap-webgui | <= 3.1.4 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| RaspAP | before 3.1.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.