Threats tagged 'ghsa-2qgh-vqj2-gcjx'

Froxlor versions from 2.3.8 up to but not including 2.3.15 have an information disclosure vulnerability. This flaw allows administrators with the customers_see_all permission to view all accounts' API keys and secrets via an unscoped query in the api_keys.php file. Exploiting this, an attacker can obtain the super administrator's API key and secret, enabling them to impersonate the super administrator and gain full control over the API.