CVE-2023-46236

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-462375.3FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer l CVE-2023-462385.4ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including CVE-2023-462397.5quic-go is an implementation of the QUIC protocol in Go. Starting in version 0.37.0 and prior to version 0.37.3, by serializing an ACK frame CVE-2023-46242.4Server-Side Request Forgery (SSRF) in GitHub repository bookstackapp/bookstack prior to v23.08.CVE-2023-462407.5CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report CVE-2023-462418.1`discourse-microsoft-auth` is a plugin that enables authentication via Microsoft. On sites with the `discourse-microsoft-auth` plugin enable CVE-2023-462428.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462438.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462448.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2023-462457.2Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI)CVE-2023-462465.5Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the CVE-2023-462477.5Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate th