Medium severity · published Oct 31, 2023
CVE-2023-46237
FOG is a free open-source cloning/imaging/rescue suite/inventory management system
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fogproject · Fogproject
before 1.5.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46237
Patch
https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b
Vendor Advisory
https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2
More from Fogproject
9.8
CVE-2024-39914
FOG has a command injection in /fog/management/export.php?filename=
9.1
CVE-2025-58443
FOG's authentication bypass leads to full SQL DB dump
8.8
CVE-2026-116778
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
8.8
CVE-2024-40645
FOG Authenticated File Upload RCE
8.8
CVE-2021-32243
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated)