CVE-2024-41108

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-41108
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41108.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-41108
Aliases
  • GHSA-p3f9-4jj4-fm2g
Published
2024-07-31T19:04:59.847Z
Modified
2026-04-10T05:15:47.874948Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
FOG Sensitive Information Disclosure
Details

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending on that host. Otherwise, an error message containing "Invalid tasking!" will be returned. The domainpassword in the hostinfo dump is hidden even to authenticated users, as it is displayed as a row of asterisks when navigating to the host's Active Directory settings. This vulnerability is fixed in 1.5.10.41.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41108.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

Git / github.com/fogproject/fogproject

Affected ranges

Type
GIT
Repo
https://github.com/fogproject/fogproject
Events
Introduced
3eaa83b73ffa59e5b0ea6009b361c9d0b3c08443
Fixed
4479e23407605b2ce1d226cb62766780722aae8c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41108.json"