CVE-2024-32019: falha de alta gravidade em netdata
ndsudo: local privilege escalation via untrusted search path
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 8.8epss 1.2%
da publicação à armano mesmo dia
Publicada no NVD12 de abr.
metasploit12 de abr.
Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
netdata · netdataCVEs relacionadas — netdata
No mesmo produto, das mais perigosas para as menos.
CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2026-83599HIGHNetdata: WebSocket Decompression BombEPSS 0.7%CVE-2023-22497MEDIUMNetdata is vulnerable to improper authenticationEPSS 0.7%CVE-2026-83600MEDIUMNetdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agentEPSS 0.5%CVE-2025-71385MEDIUMNetdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg EndpointEPSS 0.4%CVE-2026-83601MEDIUMNetdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds writeEPSS 0.4%