CVE-2024-54159

MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2024-11-29 cve@mitre.org

Denial Of Service

4.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.1 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Nov 29, 2024 - 22:15 cve.org

MEDIUM 4.1

DescriptionCVE.org

stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.

AnalysisAI

stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. Version information: through 1.19.7.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.