Description (CNA)
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain management usernames, hosts, ports, TLS settings, and cron metadata.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| froxlor / froxlor | affected 0.10.0 before 2.3.14; unaffected 2.3.14 |
CWE
CWE-285
References
- https://github.com/froxlor/froxlor/security/advisories/GHSA-mx7x-72gh-8j8f
- https://www.vulncheck.com/advisories/froxlor-0.10.0-before-2.3.14-missing-authorization-in-mysqlserver-and-cronjobs-api
ADP enrichment
No English description supplied.