Описание
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.
EPSS
Процентиль: 12%
0.00214
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-285
Связанные уязвимости
CVSS3: 4.3
debian
3 дня назад
Froxlor before 2.3.7 fails to validate the mysql_server parameter agai ...
CVSS3: 4.3
github
3 дня назад
Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.
EPSS
Процентиль: 12%
0.00214
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-285