GitHub Advisoryadvisory · Packagist

GHSA-j739-gw6q-f4c7 HTML Injection in Froxlor

MEDIUM Published 2022-04-14 Modified 2022-04-22 Official page ↗
Aliases
CVE-2020-29653
Ecosystem
Packagist
Packages
froxlor/froxlor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-04-22

Affected packages

• Packagist froxlor/froxlor: <= 0.10.22 (no fix yet)

Description

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags. Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.

Related

Alias · CVE (1)

  • CVE-2020-29653 Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References