CVE-2024-48911

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-48911
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48911.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-48911
Aliases
Published
2024-10-14T20:45:57Z
Modified
2026-08-12T03:51:27Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenCanary Executes Commands From Potentially Writable Config File
Details

OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48911.json"
}
References

Affected packages

Git / github.com/thinkst/opencanary

Affected ranges

Type
GIT
Repo
https://github.com/thinkst/opencanary
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
04357d1436e928dddf9bbbcab09a503b9c07fbb7
Fixed
2c11575b1a3dd8b0df26a879ba856c0aa350c049
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:thinkst:opencanary:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.4"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.7.1
v0.*
v0.8.0
v0.9.0
v0.9.1
v0.9.2
v0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48911.json"