CVE-2023-46235

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-462367.5FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (CVE-2023-462375.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer l CVE-2023-462385.4ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including CVE-2023-462397.5quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame CVE-2023-46242.4Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-462407.5CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report CVE-2023-462418.1`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enable CVE-2023-462428.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462438.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462448.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462457.2Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI)CVE-2023-462465.5Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the