CVE-2024-42349CWE-532

FOG has a Log Information Disclosure

Medium · published August 2, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server (fog_login_accepted.log and fog_login_failed.log), exposing the name of the user account used to manage FOG, the IP address of the computer used to login and the User-Agent. This vulnerability is fixed in 1.5.10.47.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00568 · 46.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2024-08-02T20:01Z
EPSS history
Timeline
  • 02 AUG 20:01Z
    FOG has a Log Information Disclosure
    cvelistv5