Patchfirst
Patchfirst
Chainfroxlor/froxlorPackagist:froxlor/froxlor

froxlor/froxlor: successive fixes (2022–2023)

7 CVEs over 3 generations, 28 Aug 2022 to 3 Jan 2024.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2022-301728 Aug 2022 First in the chain
  2. CVE-2022-37214 Nov 2022 next fix after CVE-2022-3869
  3. CVE-2022-38695 Nov 2022 related to CVE-2022-3017
  4. CVE-2023-031616 Jan 2023 No direct link to an earlier CVE
  5. CVE-2023-203414 Apr 2023 related to CVE-2023-0316
  6. CVE-2023-430411 Aug 2023 related to CVE-2022-3721related to CVE-2023-2034
  7. CVE-2023-502563 Jan 2024 related to CVE-2022-3721
Aug 2022OctNovDecJan 2023FebAprJunAugOctJan 2024 CVE-2022-3017 → CVE-2022-3869: related (high confidence)CVE-2022-3721 → CVE-2022-3869: Next fix in the same package (high confidence)CVE-2022-3721 → CVE-2023-4304: related (medium confidence)CVE-2022-3721 → CVE-2023-50256: related (medium confidence)CVE-2023-0316 → CVE-2023-2034: related (medium confidence)CVE-2023-2034 → CVE-2023-4304: related (medium confidence) CVE-2022-3017 28 Aug 2022 CVE-2022-3721 4 Nov 2022 CVE-2022-3869 5 Nov 2022 CVE-2023-0316 16 Jan 2023 CVE-2023-2034 14 Apr 2023 CVE-2023-4304 11 Aug 2023 CVE-2023-50256 3 Jan 2024 Aug 2022OctNovDecJan 2023FebMarAprMayJunJulAugOctJan 2024 CVE-2022-3017 → CVE-2022-3869: related (high confidence)CVE-2022-3721 → CVE-2022-3869: Next fix in the same package (high confidence)CVE-2022-3721 → CVE-2023-4304: related (medium confidence)CVE-2022-3721 → CVE-2023-50256: related (medium confidence)CVE-2023-0316 → CVE-2023-2034: related (medium confidence)CVE-2023-2034 → CVE-2023-4304: related (medium confidence) CVE-2022-3017 28 Aug 2022 CVE-2022-3721 4 Nov 2022 CVE-2022-3869 5 Nov 2022 CVE-2023-0316 16 Jan 2023 CVE-2023-2034 14 Apr 2023 CVE-2023-4304 11 Aug 2023 CVE-2023-50256 3 Jan 2024
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2022-3017 28 Aug 2022 Cross-Site Request Forgery (CSRF) in froxlor/froxlor · fixed in 0.10.38 First in chain 10.6
CVE-2022-3721 4 Nov 2022 Code Injection in froxlor/froxlor · fixed in 0.10.39 CVE-2022-3869 · Next fix in the same package · High 22.0
CVE-2022-3869 5 Nov 2022 Code Injection in froxlor/froxlor · fixed in 0.10.38.2 CVE-2022-3017 · related · High 24.0
CVE-2023-0316 16 Jan 2023 Path Traversal: '\..\filename' in froxlor/froxlor · fixed in 2.0.0 First in chain 15.7
CVE-2023-2034 14 Apr 2023 Unrestricted Upload of File with Dangerous Type in froxlor/froxlor · fixed in 2.0.14 CVE-2023-0316 · related · Medium 26.3
CVE-2023-4304 11 Aug 2023 Business Logic Errors in froxlor/froxlor · fixed in 2.0.22 CVE-2022-3721 · related · Medium 12.3
CVE-2023-50256 3 Jan 2024 Froxlor username/surname AND company field Bypass · fixed in 2.1.2 CVE-2022-3721 · related · Medium 16.0
↑ ↓ chooseEnter openEsc close