CVE-2024-28139

CVE-2024-28139: Privilege escalation through sudo misconfiguration

Vendor Image Access Gmbh
Product Scan2Net
Weakness CWE-250
Published December 11, 2024
Last update November 3, 2025

CVSS base score

What the vulnerability does

01Description

The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the privileges can be escalated to the root user. The risk has been accepted by the vendor and won't be fixed in the near future.

Key dates

02Disclosure timeline

December 11, 2024 CVE published
November 3, 2025 Record updated