Description
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering a computer. This vulnerability is fixed in 1.5.10.41.3 and 1.6.0-beta.1395.
References (1)
Core 1
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/FOGProject/fogproject/security/advisories/GHSA-456c-4gw3-c9xw
Scores
CVSS v3
9.3
EPSS
0.0059
EPSS Percentile
43.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-77
Status
published
Products (1)
fogproject/fogproject
1.5.10.41 - 1.5.10.41.3
Published
Aug 02, 2024
Tracked Since
Feb 18, 2026