PT-2014-5097 · Fog · Fog

Published 2014-10-21 · Updated 2018-10-09 · CVE-2014-3111

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FOG versions 0.27 through 0.32

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several fields, including the Printer Model field to the "Printer Management" page, the Image Name field to the "Image Management" page, the Storage Group Name field to the "Storage Management" page, the Username field to the "User Cleanup FOG Configuration" page, or the Directory Path field to the "Directory Cleaner FOG Configuration" page.

Recommendations For FOG versions 0.27 through 0.32, consider disabling the fields that allow user input to the Printer Management, Image Management, Storage Management, User Cleanup FOG Configuration, and Directory Cleaner FOG Configuration pages until a patch is available. Restrict access to these pages to minimize the risk of exploitation. Avoid using the vulnerable fields in the affected pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3111

Affected Products

Fog

References · 6

• 🔥 http://seclists.org/fulldisclosure/2014/May/60 · Exploit
• http://fogproject.org/forum/threads/stored-xss-vulnerability-in-fog-project-version-0-27-through-0-32.10394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3111 · Security Note
• http://securityfocus.com/archive/1/532091/100/0/threaded · Note
• http://securityfocus.com/bid/67141 · Note
• http://openwall.com/lists/oss-security/2014/04/30/2 · Note