CVE-2024-39916: fogproject — Fix

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.

Is your site exposed to CVE-2024-39916?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness Type (CWE)

CWE-453 CWE-453

CWE-1188 CWE-1188

Affected Products

Vendor	Product	Versions
fogproject	fogproject	< 1.5.10

References

Advisories & Patches

https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88 https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88

Other References

https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjh https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjh

Frequently Asked Questions

What is CVE-2024-39916? +

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30. It has a CVSS v3.1 base score of 6.4 (MEDIUM).

How severe is CVE-2024-39916? +

CVE-2024-39916 has a CVSS v3.1 score of 6.4 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-39916? +

CVE-2024-39916 affects products from fogproject, specifically: fogproject. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-39916? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-61926

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s …

CVE-2025-30206 9.8

Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT …

CVE-2025-47945 9.1

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) …

CVE-2024-21411 8.8

Skype for Consumer Remote Code Execution Vulnerability

CVE-2024-49120 8.1

Windows Remote Desktop Services Remote Code Execution Vulnerability

CVE-2025-48563 7.8

In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead …

CVE-2024-39916