Froxlor - Guessable Password Reset Token
Summary
CVE-2016-5100: Froxlor guessable password reset token. Affects froxlor/froxlor versions < 0.9.35. Fixed in 0.9.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Froxlor is a web-based server management panel that allows users to manage their web hosting services. It provides a user-friendly interface for managing domains, email accounts, databases, and more. However, Froxlor versions prior to 0.9.35 are vulnerable to a guessable password reset token issue.
Vulnerability Detail
The vulnerability in Froxlor arises from its use of the PHP rand function for random number generation. This makes it easier for remote attackers to predict the password reset token, potentially leading to unauthorized access to user accounts. The issue has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
0.9.35
This is the first release that contains the fix.
composer require froxlor/froxlor:0.9.35Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
Conclusion
Froxlor versions prior to 0.9.35 are vulnerable to a guessable password reset token issue. It is crucial to upgrade to the fixed version to mitigate the risk of unauthorized access to user accounts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for froxlor/froxlor →
FAQ
Froxlor is a web-based server management panel used for managing web hosting services.
The vulnerability allows remote attackers to guess the password reset token, potentially leading to unauthorized access to user accounts.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, upgrade Froxlor to version 0.9.35 or later.
No, there is no known workaround. Upgrading to the fixed version is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for froxlor/froxlor.
