CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
froxlorfroxlor
𝑥
≤ 0.10.22
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Froxlor/Froxlor/commits/master
https://github.com/Froxlor/Froxlor/security/advisories
https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/
https://github.com/Froxlor/Froxlor/commits/master
https://github.com/Froxlor/Froxlor/security/advisories
https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/