CVE-2020-10235

Опубликовано: 09 мар. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.

Ссылки

https://bugzilla.suse.com/show_bug.cgi?id=1165721
Exploit
Issue Tracking
Third Party Advisory
https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656
Patch
https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207
Patch
https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14
Patch
https://bugzilla.suse.com/show_bug.cgi?id=1165721
Exploit
Issue Tracking
Third Party Advisory
https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656
Patch
https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207
Patch
https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*

Версия до 0.10.14 (исключая)

EPSS

Процентиль: 72%

0.007

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

CVE-2020-10235

CVSS3: 8.8

debian

почти 6 лет назад

An issue was discovered in Froxlor before 0.10.14. Remote attackers wi ...

GHSA-p29c-jpgj-v57r

CVSS3: 8.8

github

больше 3 лет назад

Froxlor arbitrary code execution via the database configuration options

EPSS

Процентиль: 72%

0.007

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-78