CVE-2023-46237mediumCWE-22

CVE-2023-46237: falha de média gravidade em fogproject

FOG path traversal via unauthenticated endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar fogproject

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.8epss 0.6%
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
FOGProject · fogproject
CVEs relacionadas — fogproject

No mesmo produto, das mais perigosas para as menos.

CVE-2024-39914CRITICAL FOG has a command injection in /fog/management/export.php?filename=EPSS 23.2%CVE-2025-58443CRITICALFOG's authentication bypass leads to full SQL DB dumpEPSS 21.3%CVE-2024-40645HIGHFOG Authenticated File Upload RCEEPSS 1.0%CVE-2024-42348CRITICALFOG leaks sensitive information (AD domain, username and password)EPSS 0.6%CVE-2026-54554HIGHFOG adInfo endpoint is reported to disclose the Active Directory join passwordEPSS 0.6%CVE-2024-42349MEDIUMFOG has a Log Information DisclosureEPSS 0.6%