CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39916 – NFS server misconfiguration allows file access outside the exported directory
https://notcve.org/view.php?id=CVE-2024-39916
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. • https://github.com/FOGProject/fogproject/security/advisories/GHSA-3xjr-xf9v-hwjh https://github.com/FOGProject/fogproject/commit/2de209bc57a177a052b4a877f000c591740b2f88 • CWE-453: Insecure Default Variable Initialization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-39914 – FOG has a command injection in /fog/management/export.php?filename=
https://notcve.org/view.php?id=CVE-2024-39914
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34. • https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46237 – FOG path traversal via unauthenticated endpoint
https://notcve.org/view.php?id=CVE-2023-46237
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue. FOG es un sistema gratuito de gestión de inventario, imágenes, clonación y rescate de código abierto. • https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46236 – FOG SSRF via unauthenticated endpoint(s)
https://notcve.org/view.php?id=CVE-2023-46236
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch. • https://github.com/FOGProject/fogproject/commit/9125f35ff649a3e7fd7771b1c8e5add3c726f763 https://github.com/FOGProject/fogproject/security/advisories/GHSA-8qg4-9363-873h • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46235 – FOG stored XSS on log screen via unsanitized request logging
https://notcve.org/view.php?id=CVE-2023-46235
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard. • https://github.com/FOGProject/fogproject/commit/2e2421f19620669b9930f72fb73a8dbc5efe4980 https://github.com/FOGProject/fogproject/security/advisories/GHSA-cvf7-7mvq-5694 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •