PT-2023-29920 · Apache · Apache

0X41C · Published 2023-10-31 · Updated 2023-11-08 · CVE-2023-46237

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FOG versions prior to 1.5.10

Description The issue affects FOG, a free open-source cloning/imaging/rescue suite/inventory management system. An endpoint intended for authenticated users to have limited enumeration abilities was accessible to unauthenticated users. This allowed unauthenticated users to discover files and their paths visible to the Apache user group.

Recommendations For versions prior to 1.5.10, update to version 1.5.10 to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoint until the patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-46237

GHSA-FFP9-RHFM-98C2

Affected Products

Apache

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46237.json · Exploit
• https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b · Patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46237 · Security Note
• https://t.me/cibsecurity/73238 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1719392891464806815 · Twitter Post