What is GHSA-j739-gw6q-f4c7?

GHSA-j739-gw6q-f4c7 is a security advisory published by GitHub Security Advisories with Medium severity. HTML Injection in Froxlor

Which CVE IDs does GHSA-j739-gw6q-f4c7 cover?

GHSA-j739-gw6q-f4c7 covers the following CVE IDs: CVE-2020-29653. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j739-gw6q-f4c7?

GHSA-j739-gw6q-f4c7 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-j739-gw6q-f4c7?

GHSA-j739-gw6q-f4c7 affects 1 product, including: composer/froxlor/froxlor:\u003c= 0.10.22.

GHSA-j739-gw6q-f4c7MediumCVSS 6.1

HTML Injection in Froxlor

Vendor

GitHub Security Advisories

Published

April 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-29653 →

📋 Description

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.

🎯 Affected products1

composer/froxlor/froxlor:<= 0.10.22

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-29653
https://github.com/Froxlor/Froxlor/security/advisories
https://nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/
https://github.com/Froxlor/Froxlor/commit/6bf5eccc2477257b6c1760a3c3784ae7e0554ce0
https://github.com/advisories/GHSA-j739-gw6q-f4c7