GHSA-qwvp-g9j7-28f6

froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type

En bref

Publiée: 2023-04-14 03:30 UTC
Mise à jour: 2023-11-08 04:11 UTC
CVE: CVE-2023-2034
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

Image files uploaded in froxlor/froxlor prior to 2.0.14 were not properly validated which could result in remote code execution via path manipulation.

Paquets affectés

Paquet	Versions
Packagist · froxlor/froxlor	introduced 0, fixed 2.0.14

Références

https://nvd.nist.gov/vuln/detail/CVE-2023-2034 ADVISORY
https://github.com/froxlor/froxlor/commit/f36bc61fc74c85a21c8d31448198b11f96eb3bc6 WEB
https://github.com/Froxlor/Froxlor PACKAGE
https://huntr.dev/bounties/aba6beaa-570e-4523-8128-da4d8e374ef6 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database