PT-2021-11703 · Froxlor · Froxlor
Valerio Brussani
·
Published
2021-03-11
·
Updated
2022-04-20
·
CVE-2020-29653
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Froxlor versions 0.10.22 and earlier
Description:
The issue concerns a lack of validation on user input passed in the
customermail GET parameter. This allows the injection of arbitrary HTML tags, which are reflected in the login webpage. This can potentially be used to steal login credentials.Recommendations:
For Froxlor versions 0.10.22 and earlier, consider disabling the reflection of user input in the login webpage until a proper fix is available. Restrict access to the
customermail parameter to minimize the risk of exploitation. Note that while Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, it only provides partial protection for this particular issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Froxlor