CVE-2020-10237 Froxlor Exposure of Sensitive Information to an Unauthorized Actor
A race condition in the Froxlor installer allows local attackers to read sensitive configuration files containing passwords before permissions are set.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10237?
CVE-2020-10237 is a medium-severity vulnerability in n/a, published on 9 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
Weakness: CWE-362
Which versions are affected by CVE-2020-10237?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions to 0.10.15 | None |
froxlor/froxlor Packagist | All versions to 0.10.15 | None |
Products include Froxlor Froxlor.
How do I fix CVE-2020-10237?
No fix has been published for CVE-2020-10237 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10237 being exploited?
There is no known exploitation of CVE-2020-10237 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
Sources
Also known as GHSA-j9wr-mj69-cqmv.