CVE-2023-46237CWE-22

FOG path traversal via unauthenticated endpoint

Medium · published October 31, 2023

CVSS v3.1
5.8
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-10-31T14:59Z
EPSS history
Timeline
  • 31 OCT 14:59Z
    FOG path traversal via unauthenticated endpoint
    cvelistv5