Threats tagged 'ghsa-hxjh-8h5v-fp7m'

Froxlor versions from 2.3.0 up to but not including 2.3.15 have a missing authorization check vulnerability in the Certificates.add and Certificates.update API commands. This flaw allows customers with API access to overwrite Let's Encrypt-managed certificates and private keys with attacker-chosen values. The overwritten certificates are then deployed to the webserver by a REBUILD_VHOST task, disrupting HTTPS functionality and desynchronizing ACME automation.