CVE-2024-41954

FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.

• CWE-732
• CWE-732

• https://github.com/FOGProject/fogproject/commit/97ed6d51608e52fc087ca1d2f03d6b8df612fc90Patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-pcqm-h8cx-282cExploit, Vendor Advisory

Published

Jul 31, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41949biscuit-rust is the Rust implementation of Biscuit, an authe…6.4
• CVE-2024-4195Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x bef…2.7
• CVE-2024-41950Haystack is an end-to-end LLM framework that allows you to b…7.5
• CVE-2024-41951Pheonix App is a Python application designed to streamline v…4.4
• CVE-2024-41952Zitadel is an open source identity management system. ZITADE…5.3
• CVE-2024-41953Zitadel is an open source identity management system. ZITADE…6.1
• CVE-2024-41955Mobile Security Framework (MobSF) is a security research pla…5.4
• CVE-2024-41956Soft Serve is a self-hostable Git server for the command lin…8.1
• CVE-2024-41957Vim is an open source command line text editor. Vim < v9.1.0…5.3
• CVE-2024-41958mailcow: dockerized is an open source groupware/email suite …7.2
• CVE-2024-41959mailcow: dockerized is an open source groupware/email suite …6.1
• CVE-2024-4196An improper input validation vulnerability was discovered i…9.8