Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wMjljLWpwZ2otdjU3cs4AAjxW
Froxlor arbitrary code execution via the database configuration options
An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Permalink: https://github.com/advisories/GHSA-p29c-jpgj-v57rJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wMjljLWpwZ2otdjU3cs4AAjxW
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 11 days ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-p29c-jpgj-v57r, CVE-2020-10235
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-10235
- https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656
- https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207
- https://bugzilla.suse.com/show_bug.cgi?id=1165721
- https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14
- https://github.com/advisories/GHSA-p29c-jpgj-v57r
Blast Radius: 1.0
Affected Packages
packagist:froxlor/froxlor
Dependent packages: 0Dependent repositories: 0
Downloads: 20 total
Affected Version Ranges: < 0.10.14
Fixed in: 0.10.14
All affected versions: 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.10.8, 0.10.9, 0.10.10, 0.10.11, 0.10.12, 0.10.13
All unaffected versions: 0.10.14, 0.10.15, 0.10.16, 0.10.17, 0.10.18, 0.10.19, 0.10.20, 0.10.21, 0.10.22, 0.10.23, 0.10.24, 0.10.25, 0.10.26, 0.10.27, 0.10.28, 0.10.29, 0.10.30, 0.10.31, 0.10.32, 0.10.33, 0.10.34, 0.10.35, 0.10.36, 0.10.37, 0.10.38, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9