{"id":"CVE-2023-2666","published":"2023-05-12T00:00:00Z","modified":"2025-01-24T15:59:16Z","title":"Allocation of Resources Without Limits or Throttling in froxlor/froxlor","vendor":"froxlor","product":"froxlor/froxlor","tier":"tail","description":{"text":"Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00681,"percentile":0.52417,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://huntr.dev/bounties/0bbdc9d4-d9dc-4490-93ef-0a83b451a20f","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/1679675aa1c29d24344dd2e091ff252accb111d6","tags":[]}],"priority":{"score":15.2,"factors":[{"name":"EPSS percentile","points":10.48},{"name":"CVSS severity","points":4.76}]},"vendorSlug":"froxlor","affectedVersions":[{"vendor":"froxlor","product":"froxlor/froxlor","versions":[">= unspecified, < 2.0.16"]}],"affected":[{"ecosystem":"Packagist","package":"froxlor/froxlor","vulnerableRanges":["<2.0.16"],"patched":["2.0.16"],"from":["GHSA-4gm9-c9jq-g523"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1467","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-froxlor-froxlor-cve-2023-0315","parents":[{"from":"CVE-2023-0315","to":"CVE-2023-2666","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["install/froxlor.sql.php","install/updates/froxlor/update_2.x.inc.php","lib/Froxlor/Froxlor.php","lng/de.lng.php","lng/en.lng.php"],"commits":["https://github.com/froxlor/froxlor/commit/090cfc26f2722ac3036cc7fd1861955bc36f065a","https://github.com/froxlor/froxlor/commit/1679675aa1c29d24344dd2e091ff252accb111d6"],"basis":"shared function","functions":["Froxlor"]}]}],"children":[{"from":"CVE-2023-2666","to":"CVE-2023-3173","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"2.0.16","toFixed":"2.0.20","daysApart":28},{"kind":"same-code","provenance":"machine","files":["lng/de.lng.php","lng/en.lng.php"],"commits":["https://github.com/froxlor/froxlor/commit/1679675aa1c29d24344dd2e091ff252accb111d6","https://github.com/froxlor/froxlor/commit/464216072456efb35b4541c58e7016463dfbd9a6"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-1033","published":"2023-02-25","fixed":"2.0.11","kev":false},{"cve":"CVE-2023-1307","published":"2023-03-10","fixed":"2.0.13","kev":false},{"cve":"CVE-2023-2034","published":"2023-04-14","fixed":"2.0.14","kev":false,"link":{"from":"CVE-2023-2034","to":"CVE-2023-2666","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"2.0.14","toFixed":"2.0.16","daysApart":28}]}},{"cve":"CVE-2023-2666","published":"2023-05-12","fixed":"2.0.16","kev":false},{"cve":"CVE-2023-3172","published":"2023-06-09","fixed":"2.0.20","kev":false,"link":{"from":"CVE-2023-2666","to":"CVE-2023-3172","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"2.0.16","toFixed":"2.0.20","daysApart":28}]}},{"cve":"CVE-2023-3173","published":"2023-06-09","fixed":"2.0.20","kev":false},{"cve":"CVE-2023-3668","published":"2023-07-14","fixed":"2.0.21","kev":false}],"package":"Packagist:froxlor/froxlor"}}