CVE-2020-29653

MEDIUM6.1EPSS 0.33%

HTML Injection in Froxlor

Published: 4/14/2022Modified: 2/20/2024

Description

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags. Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.

Affected packages (1)

Packagist/froxlor/froxlorfrom 0, <= 0.10.22

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-29653
PATCHhttps://github.com/Froxlor/Froxlor
WEBhttps://github.com/Froxlor/Froxlor/commit/6bf5eccc2477257b6c1760a3c3784ae7e0554ce0
WEBhttps://github.com/Froxlor/Froxlor/security/advisories
WEBhttps://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup