CVE-2023-50256 Froxlor username/surname AND company field Bypass
Attackers can bypass mandatory field validation in the registration form by leaving essential fields blank, allowing incomplete account creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-50256?
CVE-2023-50256 is a high-severity vulnerability in Froxlor, published on 3 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.
Weakness: CWE-20
Which versions are affected by CVE-2023-50256?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 2.1.2 |
froxlor/froxlor Packagist | All versions | 2.1.2 |
Products include Froxlor Froxlor.
How do I fix CVE-2023-50256?
Upgrade froxlor/froxlor to 2.1.2 or later.
Is CVE-2023-50256 being exploited?
There is no known exploitation of CVE-2023-50256 in the wild and no public exploit code.
Other vulnerabilities in Froxlor
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
Sources
Also known as GHSA-625g-fm5w-w7w4.