CVE-2023-46236 HIGH

CVE-2023-46236: FOG SSRF via unauthenticated endpoint(s)

Vendor Fogproject
Product fogproject
Weakness CWE-918 · SSRF
Published October 31, 2023
Last update September 5, 2024
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

Key dates

02Disclosure timeline

October 31, 2023 CVE published
September 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-33766 AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints CVE-2026-0600 Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration CVE-2026-41105 Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability CVE-2026-26013 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages CVE-2026-6618 langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery