CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
An authentication bypass vulnerability in Froxlor allows attackers to gain unauthorized access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1307?
CVE-2023-1307 is a critical authentication bypass vulnerability in froxlor/froxlor, published on 10 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
Weakness: CWE-305
Which versions are affected by CVE-2023-1307?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 2.0.13 |
froxlor/froxlor Packagist | All versions | 2.0.13 |
Products include Froxlor Froxlor.
How do I fix CVE-2023-1307?
Upgrade froxlor/froxlor to 2.0.13 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-1307 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1307 exists.
Other vulnerabilities in froxlor/froxlor
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2021-42325 Froxlor SQL injection vulnerability
Sources
Also known as GHSA-j83x-r9qq-9g4v.