CVE-2023-46237
Medium
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
SeverityMedium
CVSS5.8
Exploit probability—
ProductFogproject
PublishedOct 31, 2023
First seenOct 31, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- fogproject fogproject1.5.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fogproject fogproject | v < 1.5.10 | 1.5.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.