Plaintext Credential Exposure in FOG Cloning and Management System
CVE-2024-41954

7.8HIGH

Key Information:

Vendor

Fogproject

Status
Fogproject
Vendor
CVE Published:
31 July 2024

What is CVE-2024-41954?

The FOG Imaging System, a versatile tool for cloning, imaging, and inventory management, has a vulnerability that exposes plaintext service account credentials. These credentials are stored in the configuration file located at '/opt/fog/.fogsettings', which, by default, is accessible to all users on the host. This exposure can allow malicious users to exploit the credentials, leading to unauthorized account creation and potential manipulation of the web application. The vulnerability has been addressed in version 1.5.10.41, which enhances security by ensuring sensitive information is properly protected.

References

https://github.com/FOGProject/fogproject/security/advisor...
https://github.com/FOGProject/fogproject/commit/97ed6d516...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2024-41954 : Plaintext Credential Exposure in FOG Cloning and Management System