CVE-2020-10237: Race Condition
An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords into files in /tmp, setting proper permissions only after writing the sensitive data. A local attacker could have disclosed the information if he read the file at the right time, because of createUserdataConf in install/lib/class.FroxlorInstall.php.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability identifier for this Froxlor issue?
The vulnerability identifier for this Froxlor issue is CVE-2020-10237.
What is the severity level of CVE-2020-10237?
The severity level of CVE-2020-10237 is medium with a rating of 5.5.
How does the vulnerability in Froxlor through 0.10.15 allow sensitive information disclosure?
The vulnerability in Froxlor through 0.10.15 allows sensitive information disclosure because the installer writes configuration parameters including passwords into files in /tmp without setting proper permissions immediately.
Who can exploit this vulnerability?
This vulnerability can be exploited by a local attacker who has access to read files in /tmp directory.
How can I fix the vulnerability in Froxlor 0.10.15?
To fix the vulnerability in Froxlor 0.10.15, it is recommended to update to a newer version of Froxlor that includes the necessary security patches.