CVE-2024-41108: FOG Sensitive Information Disclosure
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending on that host. Otherwise, an error message containing "Invalid tasking!" will be returned. The domainpassword in the hostinfo dump is hidden even to authenticated users, as it is displayed as a row of asterisks when navigating to the host's Active Directory settings. This vulnerability is fixed in 1.5.10.41.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41108?
CVE-2024-41108 is considered a medium severity vulnerability due to improper access control leading to potential information disclosure.
How do I fix CVE-2024-41108?
To fix CVE-2024-41108, ensure that proper access controls are implemented on the hostinfo page to restrict unauthorized access.
What type of data is exposed in CVE-2024-41108?
CVE-2024-41108 exposes configuration information that can be accessed using only a host's MAC address.
Which versions of Fogproject are affected by CVE-2024-41108?
CVE-2024-41108 affects Fogproject versions between 1.5.10 and 1.5.10.41.
Is there a workaround for CVE-2024-41108?
A temporary workaround for CVE-2024-41108 includes restricting access to the hostinfo page through firewall rules until an update is applied.