CVE-2025-29773
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
描述
### Summary the vulnerability is that users (such as resellers or customers) are able to create accounts with the same email address as an existing account (e.g., if the admin has [admin@froxlor.com](mailto:admin@froxlor.com), others can also create an account using the same email). This creates potential issues with account identification and security. ### Impact Local/Authenticated: This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. Email-based: The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues.
如何修補 CVE-2025-29773
要修補 CVE-2025-29773,請將受影響套件升級到下列已修補版本。
- —升級至 2.2.6 或更新版本
CVE-2025-29773 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 2.2.6
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N |