CVE-2023-50256

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

F

roxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.

References

Link	Resource
https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac	Patch
https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4	Exploit Vendor Advisory
https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4	Exploit
https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac	Patch
https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4	Exploit Vendor Advisory
https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:36

Type	Values Removed	Values Added
References	~~() https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac - Patch~~	() https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac - Patch
References	~~() https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4 - Exploit, Vendor Advisory~~	() https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4 - Exploit, Vendor Advisory
References	~~() https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4 - Exploit~~	() https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4 - Exploit

Information

Published : 2024-01-03 23:15

Updated : 2024-11-21 08:36

NVD link : CVE-2023-50256

Mitre link : CVE-2023-50256

CVE.ORG link : CVE-2023-50256

JSON object : View

Products Affected

froxlor

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2023-50256", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-01-03T23:15:08.517", "references": [{"url": "https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://github.com/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.\n"}, {"lang": "es", "value": "Froxlor es un software de administraci\u00f3n de servidores de c\u00f3digo abierto. Antes de la versi\u00f3n 2.1.2, era posible enviar el formulario de registro con los campos esenciales, como el username y la password, dejados intencionalmente en blanco. Esta omisi\u00f3n inadvertida permiti\u00f3 omitir los requisitos de campo obligatorios (por ejemplo, apellido, nombre de la empresa) establecidos por el sistema. La versi\u00f3n 2.1.2 soluciona este problema."}], "lastModified": "2024-11-21T08:36:45.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "474D793F-0B1C-43DC-979C-29B4A48045FE", "versionEndExcluding": "2.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}