PT-2023-29920 · Apache · Apache

0X41C · Publicado 2023-10-31 · Atualizado 2023-11-08 · CVE-2023-46237

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FOG versions prior to 1.5.10

Description The issue affects FOG, a free open-source cloning/imaging/rescue suite/inventory management system. An endpoint intended for authenticated users to have limited enumeration abilities was accessible to unauthenticated users. This allowed unauthenticated users to discover files and their paths visible to the Apache user group.

Recommendations For versions prior to 1.5.10, update to version 1.5.10 to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoint until the patch is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-46237

GHSA-FFP9-RHFM-98C2

Produtos afetados

Apache

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46237.json · Exploit
• https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b · Correção
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-46237 · Aviso do Fabricante
• https://t.me/cibsecurity/73238 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46237 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1719392891464806815 · Publicação no Twitter