CVE-2020-29653

EUVD-2022-1772
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
froxlorfroxlor
𝑥
≤ 0.10.22
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Froxlor/Froxlor/commits/master
https://github.com/Froxlor/Froxlor/security/advisories
https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/
https://github.com/Froxlor/Froxlor/commits/master
https://github.com/Froxlor/Froxlor/security/advisories
https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/