GHSA-qwvp-g9j7-28f6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-qwvp-g9j7-28f6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-qwvp-g9j7-28f6/GHSA-qwvp-g9j7-28f6.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-qwvp-g9j7-28f6
- Aliases
- Published
- 2023-04-14T03:30:29Z
- Modified
- 2023-11-01T05:00:52.867482Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type
- Details
-
Image files uploaded in froxlor/froxlor prior to 2.0.14 were not properly validated which could result in remote code execution via path manipulation.
- Database specific
{ "severity": "CRITICAL", "cwe_ids": [ "CWE-434" ], "nvd_published_at": "2023-04-14T01:15:00Z", "github_reviewed_at": "2023-04-17T17:44:07Z", "github_reviewed": true }- References
Affected packages
Packagist / froxlor/froxlor
Package
- Name
- froxlor/froxlor
- Purl
- pkg:composer/froxlor/froxlor
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.0.14
Affected versions
0.*
0.10.0-rc1
0.10.0-rc2
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.10.10
0.10.11
0.10.12
0.10.13
0.10.14
0.10.15
0.10.16
0.10.17
0.10.18
0.10.19
0.10.20
0.10.21
0.10.22
0.10.23
0.10.23.1
0.10.24
0.10.25
0.10.26
0.10.27
0.10.28
0.10.29
0.10.29.1
0.10.30
0.10.31
0.10.32
0.10.33
0.10.34
0.10.34.1
0.10.35
0.10.35.1
0.10.36
0.10.37
0.10.38
0.10.38.1
0.10.38.2
0.10.38.3
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.0.13