CVE-2024-39914

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39914
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f Patch
https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j Exploit Vendor Advisory
https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f Patch
https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*
History

29 Sep 2025, 13:51

Type Values Removed Values Added
First Time Fogproject
Fogproject fogproject
CPE cpe:2.3:a:fogproject:fogproject:*:*:*:*:*:*:*:*
References () https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f - () https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f - Patch
References () https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j - () https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j - Exploit, Vendor Advisory

21 Nov 2024, 09:28

Type Values Removed Values Added
Summary
  • (es) FOG es un sistema de gestión de inventario, clonación, imágenes, suite de rescate. Antes de 1.5.10.34, paquetes/web/lib/fog/reportmaker.class.php en FOG se veía afectado por una inyección de comando a través del parámetro de nombre de archivo en /fog/management/export.php. Esta vulnerabilidad se solucionó en 1.5.10.34.
References () https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f - () https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f -
References () https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j - () https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j -

12 Jul 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-12 15:15

Updated : 2025-09-29 13:51

NVD link : CVE-2024-39914

Mitre link : CVE-2024-39914

CVE.ORG link : CVE-2024-39914

JSON object : View

Products Affected

fogproject

  • fogproject
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')