VULNERABILITY INTELLIGENCE

CVE-2024-7062

CVSS score8.8 HIGH
EPSS probability0.25%
CISA KEVNot currently listed
Published2024-07-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

Nimble Commander suffers from a privilege escalation vulnerability due to the server (info.filesmanager.Files.PrivilegedIOHelperV2) performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as the root user, such as changing permissions and ownership, obtaining a handle (file descriptor) of an arbitrary file, and terminating processes, among other operations.

Weakness classification

  • 41c37e40-543d-43a2-b660-2fee83ea851a: CWE-863
  • nvd@nist.gov: CWE-863

Primary references