An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
References:GSA_kwCzR0hTQS1qOXdyLW1qNjktY3Ftds4AAjxa
Froxlor Exposure of Sensitive Information to an Unauthorized Actor
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:froxlor/froxlor | <= 0.10.15 | No known fixed version | |
Affected Version RangesAll affected versions0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.10.8, 0.10.9, 0.10.10, 0.10.11, 0.10.12, 0.10.13, 0.10.14, 0.10.15 |
|||