CVEvulnerability
CVE-2020-29653
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-04-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
Affected configurations
• froxlor froxlor (<= 0.10.22)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/Froxlor/Froxlor/commits/master Patch, Third Party Advisory
- https://github.com/Froxlor/Froxlor/security/advisories Not Applicable, Third Party Advisory
- https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/ Exploit, Third Party Advisory
- https://github.com/Froxlor/Froxlor/commits/master Patch, Third Party Advisory
- https://github.com/Froxlor/Froxlor/security/advisories Not Applicable, Third Party Advisory
- https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/ Exploit, Third Party Advisory