CVE-2023-46236

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.

• CWE-918

• https://github.com/FOGProject/fogproject/commit/9125f35ff649a3e7fd7771b1c8e5add3c726f763Patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-8qg4-9363-873hVendor Advisory
• https://github.com/FOGProject/fogproject/commit/9125f35ff649a3e7fd7771b1c8e5add3c726f763Patch
• https://github.com/FOGProject/fogproject/security/advisories/GHSA-8qg4-9363-873hVendor Advisory

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46230In Splunk Add-on Builder versions below 4.1.4, the app write…4.9
• CVE-2023-46231In Splunk Add-on Builder versions below 4.1.4, the applicati…7.2
• CVE-2023-46232era-compiler-vyper is the EraVM Vyper compiler for zkSync Er…5.3
• CVE-2023-46233crypto-js is a JavaScript library of crypto standards. Prior…9.1
• CVE-2023-46234browserify-sign is a package to duplicate the functionality …7.5
• CVE-2023-46235FOG is a free open-source cloning/imaging/rescue suite/inven…6.1
• CVE-2023-46237FOG is a free open-source cloning/imaging/rescue suite/inven…5.3
• CVE-2023-46238ZITADEL is an identity infrastructure management system. ZIT…5.4
• CVE-2023-46239quic-go is an implementation of the QUIC protocol in Go. Sta…7.5
• CVE-2023-4624Server-Side Request Forgery (SSRF) in GitHub repository book…2.4
• CVE-2023-46240CodeIgniter is a PHP full-stack web framework. Prior to Code…7.5
• CVE-2023-46241`discourse-microsoft-auth` is a plugin that enables authenti…8.1