What is CVE-2023-46236?

CVE-2023-46236 is a high-severity vulnerability in Fogproject, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2023-10-31.

How severe is CVE-2023-46236?

High severity. CVSS v3 base score is 8.6 out of 10.

SSRF in Fogproject

CVE-2023-46236

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published 2023-10-31 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (37.6th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Fogproject — versions < 1.5.10

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

github.com/FOGProject/fogproject/security/advisories/GHSA-8qg4-9363-873h (Vendor Advisory)
github.com/FOGProject/fogproject/commit/9125f35ff649a3e7fd7771b1c8e5add3c726f763 (Patch)

Frequently asked questions

What is CVE-2023-46236?: CVE-2023-46236 is a high-severity vulnerability in Fogproject, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2023-10-31.
How severe is CVE-2023-46236?: High severity. CVSS v3 base score is 8.6 out of 10.