PT-2018-9424 · Froxlor Team · Froxlor

Prodigysml · Publicado 2018-06-26 · Atualizado 2022-05-13 · CVE-2018-1000527

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.9.39.5

Description The issue concerns a PHP Object Injection vulnerability in the Domain name form, potentially leading to information disclosure and remote code execution. This can be exploited by passing malicious PHP objects in the $ POST['ssl ipandport'] variable.

Recommendations For versions prior to 0.9.39.5, update to a version that includes the fix committed after c1e62e6 to resolve the issue. As a temporary workaround, consider restricting access to the Domain name form to minimize the risk of exploitation. Avoid using the $ POST['ssl ipandport'] variable in the affected form until the issue is resolved.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2018-1000527

GHSA-G77V-M226-3F7G

Produtos afetados

Froxlor

Referências · 7

• https://github.com/Froxlor/Froxlor/issues/555 · Nota
• https://github.com/Froxlor/Froxlor/commit/c1e62e6be719affc003774a639de5c952ffd8ffc · Nota
• https://github.com/Froxlor/Froxlor · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000527 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000527 · Aviso do Fabricante
• https://0dd.zone/2018/05/31/Froxlor-Object-Injection · Nota
• https://osv.dev/vulnerability/GHSA-g77v-m226-3f7g · Aviso do Fabricante