PT-2020-11993 · Froxlor · Froxlor

Johannes Segitz · Published 2020-03-09 · Updated 2022-05-24 · CVE-2020-10237

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.10.16

Description An issue was discovered where the installer wrote configuration parameters, including passwords, into files in /tmp without proper permissions, allowing a local attacker to disclose the information if the file was read at the right time. This is due to the createUserdataConf function in install/lib/class.FroxlorInstall.php.

Recommendations For Froxlor versions prior to 0.10.16, update to version 0.10.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation.

Fix

Information Disclosure

Race Condition

Weakness Enumeration

CWE-200

CWE-362

Related Identifiers

CVE-2020-10237

GHSA-J9WR-MJ69-CQMV

Affected Products

Froxlor

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-10237 · Security Note
• https://osv.dev/vulnerability/GHSA-j9wr-mj69-cqmv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10237 · Vendor Advisory
• https://github.com/Froxlor/Froxlor · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1165719 · Note