CVE-2023-46236 - CVE House

Back to Database

Status published High CVE-2023-46236

FOG SSRF via unauthenticated endpoint(s)

8.6 CVSS

Vulnerability Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46236

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from FOGProject

View All →

FOG's authentication bypass leads to full SQL DB dump

FOG has a Log Information Disclosure

FOG leaks sensitive information (AD domain, username and password)

FOG Weak file permissions

FOG Sensitive Information Disclosure

Affected Vendor

FOGProject

View all reports →

Affected Software

fogproject

Vulnerable Versions:

< 1.5.10

Timeline

Official Publish: October 31st, 2023

Last Modified: September 5th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery