CVE-2024-42348CWE-77

FOG leaks sensitive information (AD domain, username and password)

Critical · published August 2, 2024

CVSS v3.1
9.3
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

🚨 Your Active Directory usernames and passwords could be slipping out when registering computers on FOG Server 1.5.10.41.2! 🔥 Think of it like a hotel check-in desk that accidentally shouts out your room number and key every time a new guest arrives. It’s a recipe for disaster if someone’s listening! An attacker could easily scoop up your sensitive credentials, effectively gaining unauthorized access to your network and potentially wreaking havoc. With such information, they could impersonate users or access restricted resources, leaving your organization vulnerable to breaches and data loss.

Put simply

Think of it like a hotel check-in desk that accidentally shouts out your room number and key every time a new guest arrives. It’s a recipe for disaster if someone’s listening! This vulnerability allows sensitive Active Directory credentials to be leaked during the computer registration process, exposing usernames and passwords. The flaw exists in FOG Server version 1.5.10.41.2 and can be exploited without authentication, making it critical to address immediately.

What to do

An attacker could easily scoop up your sensitive credentials, effectively gaining unauthorized access to your network and potentially wreaking havoc. With such information, they could impersonate users or access restricted resources, leaving your organization vulnerable to breaches and data loss. Update your FOG Server to version 1.5.10.41.3 or the newer 1.6.0-beta.1395 to patch this vulnerability. Regularly review your server configurations and monitor for any unusual activity following the update. You can tackle this vulnerability! By following these steps, you’ll reinforce your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00587 · 47.3th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2024-08-02T19:58Z
EPSS history
Timeline
  • 02 AUG 19:58Z
    FOG leaks sensitive information (AD domain, username and password)
    cvelistv5