Improper Encoding or Escaping of Output in froxlor/froxlor
CVE-2023-3668

9.1CRITICAL

Key Information:

Vendor

Froxlor

Status
Froxlor/froxlor
Vendor
CVE Published:
14 July 2023

What is CVE-2023-3668?

The Froxlor product is impacted by an improper encoding or escaping of output vulnerability. This flaw can potentially be exploited to execute cross-site scripting (XSS) attacks, allowing malicious actors to inject arbitrary scripts into web pages viewed by users. The vulnerability exists prior to version 2.0.21, emphasizing the importance of updating to the latest version to mitigate risks.

Affected Version(s)

froxlor/froxlor < 2.0.21

References

https://huntr.dev/bounties/df8cccf4-a340-440e-a7e0-1b42e7...
https://github.com/froxlor/froxlor/commit/03b5a921ff308ee...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.