VulnerabilityModified
CVE-2020-29653
The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
MEDIUM 6.1EPSS 1.43%
Does this matter?
Lower severity and a low EPSS score (1.43%). Track it; it rarely justifies an emergency change on its own.
Description
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.43% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- froxlor/froxlor
- Source
- cve@mitre.org
References
- https://github.com/Froxlor/Froxlor/commits/masterPatch, Third Party Advisory
- https://github.com/Froxlor/Froxlor/security/advisoriesNot Applicable, Third Party Advisory
- https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/Exploit, Third Party Advisory
- https://github.com/Froxlor/Froxlor/commits/masterPatch, Third Party Advisory
- https://github.com/Froxlor/Froxlor/security/advisoriesNot Applicable, Third Party Advisory
- https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.