CVE-2024-42349
Medium
Description
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server (fog_login_accepted.log and fog_login_failed.log), exposing the name of the user account used to manage FOG, the IP address of the computer used to login and the User-Agent. This vulnerability is fixed in 1.5.10.47.
SeverityMedium
CVSS5.3
Exploit probability—
ProductFogproject
PublishedAug 2, 2024
First seenAug 2, 2024
Weakness typeCWE-532CWE-532
How to fix
Update
- fogproject fogproject1.5.10.47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fogproject fogproject | v < 1.5.10.47 | 1.5.10.47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.