GitHub Advisoryadvisory · Packagist

GHSA-j9wr-mj69-cqmv Froxlor Exposure of Sensitive Information to an Unauthorized Actor

MEDIUM Published 2022-05-24 Modified 2024-04-25 Official page ↗
Aliases
CVE-2020-10237
Ecosystem
Packagist
Packages
froxlor/froxlor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-25

Affected packages

• Packagist froxlor/froxlor: <= 0.10.15 (no fix yet)

Description

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.

Related

Alias · CVE (1)

  • CVE-2020-10237 An issue was discovered in Froxlor through 0.10.15. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References