CVE-2023-46237mediumCWE-22

CVE-2023-46237: medium-severity vulnerability in fogproject

FOG path traversal via unauthenticated endpoint

Published · Updated

Follow this CVE+ Monitor fogproject

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.8epss 0.6%
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected products
FOGProject · fogproject
Related CVEs — fogproject

In the same product, most dangerous first.

CVE-2024-39914CRITICAL FOG has a command injection in /fog/management/export.php?filename=EPSS 23.2%CVE-2025-58443CRITICALFOG's authentication bypass leads to full SQL DB dumpEPSS 21.3%CVE-2024-40645HIGHFOG Authenticated File Upload RCEEPSS 1.0%CVE-2024-42348CRITICALFOG leaks sensitive information (AD domain, username and password)EPSS 0.6%CVE-2026-54554HIGHFOG adInfo endpoint is reported to disclose the Active Directory join passwordEPSS 0.6%CVE-2024-42349MEDIUMFOG has a Log Information DisclosureEPSS 0.6%