CVE-2020-29653 HTML Injection in Froxlor
Attackers can inject arbitrary HTML into the login page via the customermail parameter, potentially stealing credentials or executing scripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-29653?
CVE-2020-29653 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.
Weakness: CWE-79
Which versions are affected by CVE-2020-29653?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions to 0.10.22 | None |
froxlor/froxlor Packagist | All versions to 0.10.22 | None |
Products include Froxlor Froxlor.
How do I fix CVE-2020-29653?
No fix has been published for CVE-2020-29653 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-29653 being exploited?
There is no known exploitation of CVE-2020-29653 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
Sources
Also known as GHSA-j739-gw6q-f4c7.