froxlor · froxlor/froxlor
Froxlor/froxlor, the open-source web hosting control panel, contains an unrestricted file upload flaw (CWE: Unrestricted Upload of File with Dangerous Type) in versions prior to 2.0.14. An attacker who has high-privilege authentication to the application over the network, and no user interaction, can upload files of dangerous types, with high impact to confidentiality, integrity and availability.
Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.
Disclosed on 14 Apr 2023. No public exploit code or confirmed exploitation is recorded.
7 fixes in froxlor/froxlor over 4 months. The latest fix listed for froxlor/froxlor is 2.0.20.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: froxlor/froxlor.
Upgrade to 2.0.14 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-0315).
Set the version to 2.0.14 or later in your composer.json.
The first fix for CVE-2023-2034.
| If you run | Upgrade to |
|---|---|
| All versions before 2.0.14 | 2.0.14 |
“Up to” means the second version is the fix and is not affected.