Access Control Flaw in FOG Imaging and Management System

CVE-2024-41108

What is CVE-2024-41108?

An access control vulnerability exists in the FOG Project's hostinfo feature, allowing unauthorized retrieval of configuration information by using only the host's MAC address. This attack avenue is restricted to instances where a task is currently pending for the host; else, an error message is displayed. Although sensitive information such as the domain password is concealed with asterisks, this flaw could enable malicious users to gain insights into the system's configuration, potentially leading to further security breaches. The issue has been rectified in version 1.5.10.41.

References