Threat Investigation
Request a demo

CVE-2023-46236

High

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

SeverityHigh
CVSS8.6
Exploit probability—
ProductFogproject
PublishedOct 31, 2023
First seenOct 31, 2023
Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update
  • fogproject fogproject1.5.10 or later

Affected products

ProductAffected versionsFixed in
fogproject fogprojectv < 1.5.101.5.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.