« Volver al listado

CVE-2024-42349

Estado: AnalizadaMedia (5.3)—

FOG es un sistema de gestión de inventario, clonación, imágenes, suite de rescate. FOG Server 1.5.10.41.4 y versiones anteriores pueden filtrar inicios de sesión autorizados y rechazados a través de registros almacenados directamente en la raíz del servidor web. FOG Server crea 2 registros en la raíz del servidor web (fog_login_accepted.log y fog_login_failed.log), exponiendo el nombre de la cuenta de usuario utilizada para administrar FOG, la dirección IP de la computadora utilizada para iniciar sesión y el User-Agent. Esta vulnerabilidad se solucionó en 1.5.10.47.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fogproject — Fogproject

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-42349",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-42349",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-05T19:40:49.867520Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "FOGProject",
          "product": "fogproject",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.5.10.47"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*"
          ],
          "vendor": "fogproject",
          "product": "fogproject",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.5.10.47",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-02T20:17:03.040",
  "references": [
    {
      "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-697m-3c4p-g29h",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of the web server (fog_login_accepted.log and fog_login_failed.log), exposing the name of the user account used to manage FOG, the IP address of the computer used to login and the User-Agent. This vulnerability is fixed in 1.5.10.47."
    },
    {
      "lang": "es",
      "value": "FOG es un sistema de gestión de inventario, clonación, imágenes, suite de rescate. FOG Server 1.5.10.41.4 y versiones anteriores pueden filtrar inicios de sesión autorizados y rechazados a través de registros almacenados directamente en la raíz del servidor web. FOG Server crea 2 registros en la raíz del servidor web (fog_login_accepted.log y fog_login_failed.log), exponiendo el nombre de la cuenta de usuario utilizada para administrar FOG, la dirección IP de la computadora utilizada para iniciar sesión y el User-Agent. Esta vulnerabilidad se solucionó en 1.5.10.47."
    }
  ],
  "lastModified": "2026-06-17T07:49:18.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA9FBAC7-763A-47A4-83FB-0CF0582960DB",
              "versionEndExcluding": "1.5.10.47"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}