Threats tagged 'ghsa-qjpj-j6j4-mcpf'

In froxlor versions 2.3.10 and earlier, the URL validation function Validate::validateUrl does not properly inspect the userinfo component of URLs for carriage return and line feed characters. This allows an authenticated low-privilege user with subdomain creation rights to inject malicious payloads into the web server configuration. The injected directives can execute with root privileges, enabling server-wide impact such as response hijacking or local file reading. The vulnerability is fixed in version 2.3.12.