PT-2020-11992 · Froxlor · Froxlor

Johannes Segitz · Published 2020-03-09 · Updated 2022-05-24 · CVE-2020-10236

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.10.14

Description An issue in the installation process of Froxlor allowed local attackers to cause denial of service (DoS) or disclose information from configuration files. This occurred when the installation directory was not writable, resulting in files being created with static names in the /tmp directory. The createUserdataConf function in install/lib/class.FroxlorInstall.php was involved in this issue.

Recommendations For versions prior to 0.10.14, update to version 0.10.14 or later to resolve the issue. As a temporary workaround, consider restricting write access to the /tmp directory or ensuring the installation directory is writable to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-10236

GHSA-HVGF-2RF7-WRX9

Affected Products

Froxlor

References · 7

• https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14 · Patch
• https://github.com/Froxlor/Froxlor/commit/6b09720ef8a1cc008751dd0ca0140a0597fedce5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10236 · Security Note
• https://osv.dev/vulnerability/GHSA-hvgf-2rf7-wrx9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10236 · Vendor Advisory
• https://github.com/Froxlor/Froxlor · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1165718 · Note