CVE-2023-3668 Improper Encoding or Escaping of Output in froxlor/froxlor
Attackers can inject malicious scripts via improper output encoding in Froxlor, potentially leading to session hijacking or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3668?
CVE-2023-3668 is a critical cross-site scripting vulnerability in froxlor/froxlor, published on 14 Jul 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
Weakness: CWE-116
Which versions are affected by CVE-2023-3668?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 2.0.21 |
froxlor/froxlor Packagist | All versions | 2.0.21 |
Products include Froxlor Froxlor.
How do I fix CVE-2023-3668?
Upgrade froxlor/froxlor to 2.0.21 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-3668 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3668 exists.
Other vulnerabilities in froxlor/froxlor
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
Sources
Also known as GHSA-c6v5-pf66-xfq8.