PT-2024-27099 · Raspap · Raspap

Billz · Published 2024-11-29 · Updated 2025-07-02 · CVE-2024-36622

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RaspAP raspap-webgui versions 3.0.9 and earlier

Description A command injection issue exists in the clearlog.php script due to improper sanitization of user input passed via the logfile parameter. This allows for potential exploitation.

Recommendations For versions 3.0.9 and earlier, as a temporary workaround, consider restricting access to the clearlog.php script until a patch is available. Avoid using the logfile parameter in the affected script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-36622

Affected Products

Raspap

References · 8

• https://github.com/raspap/raspap-webgui/commit/c98d2b0c15942b4829d31dec615b9b40cc6faa14#diff-939ee414d82245c3b3dd7d36b57f10706e06e8f0871b24bdcf9de6e0d181c4c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36622 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36622 · Vendor Advisory
• https://github.com/RaspAP/raspap-webgui/blob/3.0.9/ajax/logging/clearlog.php · Note
• https://twitter.com/VulmonFeeds/status/1862852148892971357 · Twitter Post
• https://t.me/cvenotify/127505 · Telegram Post
• https://twitter.com/CVEnew/status/1862568559907311754 · Twitter Post
• https://gist.github.com/1047524396/ab997b902ec892e592a0df93f38e6941 · Note