What is CVE-2023-46236?

CVE-2023-46236 is a high-severity vulnerability in Fogproject, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2023-10-31.

How severe is CVE-2023-46236?

High severity. CVSS v3 base score is 8.6 out of 10.

SSRF in Fogproject

CVE-2023-46236

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.005 (37.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

Affected products

Fogproject — versions < 1.5.10

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-46236?: CVE-2023-46236 is a high-severity vulnerability in Fogproject, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2023-10-31.
How severe is CVE-2023-46236?: High severity. CVSS v3 base score is 8.6 out of 10.