CVE-2023-50256 json
Froxlor username/surname AND company field Bypass
published 2024-01-03 2 y ago modified 2026-09-10 1 mo ago also GHSA-625g-fm5w-w7w4 , EUVD-2024-0264
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4 referenced PoC, tagged "exploit" by a source, unverified
- user-images.githubusercontent.com https://user-images.githubusercontent.com/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | froxlor/froxlor | <2.1.2 |
2.1.2 |
Affected products
- Froxlor Froxlor
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/Froxlor/Froxlor/commit/4b1846883d4828962add91bd844596d89a9c7cac
web, patch
-
github.com
/Froxlor/Froxlor/security/advisories/GHSA-625g-fm5w-w7w4
web, exploit, vendor-advisory
-
user-images.githubusercontent.com
/80028768/289675319-81ae8ebe-1308-4ee3-bedb-43cdc40da474.mp4
web, exploit
-
nvd.nist.gov
/vuln/detail/CVE-2023-50256
advisory
-
github.com
/Froxlor/Froxlor
package
Sources
- CVE List CVE-2023-50256
- GitHub Advisory GHSA-625g-fm5w-w7w4
- NVD CVE-2023-50256
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.