CVE-2023-46236

HIGH

FOG Project <1.5.10 - Unauthenticated Server-Side Request Forgery

Title source: manual
STIX 2.1

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

References (2)

Core 2

Scores

CVSS v3 8.6
EPSS 0.0046
EPSS Percentile 36.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (1)
fogproject/fogproject < 1.5.10
Published Oct 31, 2023
Tracked Since Feb 18, 2026