PT-2024-29885 · Unknown · Fog Server

Abotzung · Published 2024-08-02 · Updated 2024-09-10 · CVE-2024-42348

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions FOG Server versions prior to 1.5.10.41.3 FOG Server versions prior to 1.6.0-beta.1395

Description The issue concerns a cloning/imaging/rescue suite/inventory management system where a specific version of the FOG Server can leak AD username and password when registering a computer.

Recommendations For FOG Server version 1.5.10.41.2, update to version 1.5.10.41.3 to resolve the issue. For versions prior to 1.6.0-beta.1395, update to version 1.6.0-beta.1395 to resolve the issue.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-42348

GHSA-456C-4GW3-C9XW

Affected Products

Fog Server

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42348.json · Exploit
• 🔥 https://github.com/FOGProject/fogproject/security/advisories/GHSA-456c-4gw3-c9xw · Exploit
• https://osv.dev/vulnerability/CVE-2024-42348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42348 · Security Note
• https://t.me/cvedetector/2376 · Telegram Post