« Volver al listado

CVE-2023-46237

Estado: ModificadaMedia (5.3)—

FOG es un sistema gratuito de gestión de inventario, imágenes, clonación y rescate de código abierto. Antes de la versión 1.5.10, los usuarios no autenticados podían acceder a un endpoint destinado a ofrecer capacidades de enumeración limitadas a usuarios autenticados. Esto permitió a los usuarios no autenticados descubrir archivos y sus respectivas rutas que eran visibles para el grupo de usuarios de Apache. La versión 1.5.10 contiene un parche para este problema.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fogproject — Fogproject

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-46237",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-46237",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-05T17:39:04.385914Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "FOGProject",
          "product": "fogproject",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.5.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-31T15:15:09.707",
  "references": [
    {
      "url": "https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/FOGProject/fogproject/commit/68d73740d7d40aee77cfda3fb8199d58bf04f48b",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-ffp9-rhfm-98c2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue."
    },
    {
      "lang": "es",
      "value": "FOG es un sistema gratuito de gestión de inventario, imágenes, clonación y rescate de código abierto. Antes de la versión 1.5.10, los usuarios no autenticados podían acceder a un endpoint destinado a ofrecer capacidades de enumeración limitadas a usuarios autenticados. Esto permitió a los usuarios no autenticados descubrir archivos y sus respectivas rutas que eran visibles para el grupo de usuarios de Apache. La versión 1.5.10 contiene un parche para este problema."
    }
  ],
  "lastModified": "2026-06-17T06:30:29.407",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0A79C05-662C-4102-B8D5-7FCA7C19A1C2",
              "versionEndExcluding": "1.5.10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}