PT-2026-62110 · Fogproject · Fogproject

CVE-2026-47688 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-47688

Produtos afetados

Fogproject

Referências · 2

• https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-47688 · Nota de Segurança