CVE-2026-24138

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24138", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.475Z", "datePublished": "2026-01-23T00:19:33.776Z", "dateUpdated": "2026-01-23T19:56:37.266Z"}, "containers": {"cna": {"title": "FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj"}], "affected": [{"vendor": "FOGProject", "product": "fogproject", "versions": [{"version": "<= 1.5.10.1754", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T00:19:33.776Z"}, "descriptions": [{"lang": "en", "value": "FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication."}], "source": {"advisory": "GHSA-79xw-c2qx-g7xj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T19:56:16.055610Z", "id": "CVE-2026-24138", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:56:37.266Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24138", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.475Z", "datePublished": "2026-01-23T00:19:33.776Z", "dateUpdated": "2026-01-23T19:56:37.266Z"}, "containers": {"cna": {"title": "FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj"}], "affected": [{"vendor": "FOGProject", "product": "fogproject", "versions": [{"version": "<= 1.5.10.1754", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-23T00:19:33.776Z"}, "descriptions": [{"lang": "en", "value": "FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication."}], "source": {"advisory": "GHSA-79xw-c2qx-g7xj", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24138", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T19:56:16.055610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:56:23.958Z"}}]}}

{"affected": [{"affectedData": [{"product": "fogproject", "vendor": "FOGProject", "versions": [{"status": "affected", "version": "<= 1.5.10.1754"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites and files on the machine running FOG. This appears to be reachable without an authenticated web session when the request includes newService=1. The issue does not have a fixed release version at the time of publication."}, {"lang": "es", "value": "FOG es un sistema de gesti\u00f3n de inventario/suite de clonaci\u00f3n/creaci\u00f3n de im\u00e1genes/rescate de c\u00f3digo abierto gratuito. Las versiones 1.5.10.1754 e inferiores contienen una vulnerabilidad SSRF no autenticada en getversion.php que puede ser activada al proporcionar un par\u00e1metro de URL controlado por el usuario. Puede ser utilizada para obtener tanto sitios web internos como archivos en la m\u00e1quina que ejecuta FOG. Esto parece ser alcanzable sin una sesi\u00f3n web autenticada cuando la solicitud incluye newService=1. El problema no tiene una versi\u00f3n de lanzamiento corregida en el momento de la publicaci\u00f3n."}], "id": "CVE-2026-24138", "lastModified": "2026-10-06T22:10:00.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24138", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T19:56:16.055610Z", "version": "2.0.3"}}]}, "published": "2026-01-23T01:15:51.023", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-79xw-c2qx-g7xj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:28:29.578561+00:00", "value": {"mitigation_remediation": ["Restrict network access to the FOG server by placing it behind a firewall or VPN that only allows trusted IP addresses.", "Configure the web server to block or require authentication for the getversion.php endpoint, effectively preventing unauthenticated SSRF requests.", "Monitor the FOGProject vulnerability tracker and promptly apply the vendor\u2019s patch once a fixed release is issued.", "In the interim, disallow the newService parameter or filter the URL input to ensure only approved destinations are allowed."], "summary": {"action": "Monitor", "impact": "Unauthenticated SSRF enabling internal data exposure"}, "threat_synthesis": {"affected_systems": "FOGProject, specifically FOGProject 1.5.10.1754 and earlier. No fixed release available at the time of publication. The flaw is present in all installations of the indicated versions across platforms supported by FOG.", "description_and_impact": "The vulnerability is an unauthenticated Server Side Request Forgery that can be triggered through the getversion.php endpoint of FOGProject when the newService=1 parameter is included and a user\u2011controlled URL is supplied. The flaw allows the attacker to command the FOG server to fetch arbitrary URLs or local files, giving them the ability to read internal web pages, services, or file data on the host. Depending on the exposed internal resources, this could lead to further exploitation such as additional SSRF or remote code execution if those services are vulnerable.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity due to the combined impact of data exposure and potential compromise of internal resources. The EPSS score is less than 1% reflecting a low probability that this flaw will be exploited in the wild at the time of analysis. The flaw is not listed as a known exploited vulnerability in the CISA KEV catalog. Exploitation requires the ability to send an HTTP request to the vulnerable endpoint, which can be done from any network that can reach the FOG server. No authentication or complex prerequisites are needed beyond sending a request with newService=1 and a URL parameter, making the attack path straightforward for an attacker with network access to the victim."}}}}, "created": "2026-01-23T10:26:45.235782+00:00", "updated": "2026-04-18T03:30:25.913963+00:00", "vendors": ["fogproject", "fogproject$PRODUCT$fogproject"]}