CVE-2023-46235 FOG stored XSS on log screen via unsanitized request logging
Attackers can inject malicious scripts into FOG server logs, which execute when administrators view the log dashboard, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-46235?
CVE-2023-46235 is a medium-severity cross-site scripting vulnerability in fogproject, published on 31 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the logs, they would be parsed as HTML and displayed accordingly. Version 1.5.10.15 contains a patch. As a workaround, view logs from an external text editor rather than the dashboard.
Which versions are affected by CVE-2023-46235?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2023-46235?
No fix has been published for CVE-2023-46235 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-46235 being exploited?
There is no known exploitation of CVE-2023-46235 in the wild and no public exploit code.
Other vulnerabilities in fogproject
- CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a
Sources
Also known as GHSA-cvf7-7mvq-5694.