Vulnerability · Published Oct 31, 2023 · Assigned by GitHub_M

CVE-2023-46237FOG path traversal via unauthenticated endpoint

Medium 5.8

In plain English

A medium-severity path traversal in fogproject from FOGProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.

Affected products (as reported)

Vendor	Product	Versions
FOGProject	fogproject	< 1.5.10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2 x_refsource_CONFIRM
https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b x_refsource_MISC