{"id":"CVE-2022-3869","published":"2022-11-05T00:00:00Z","modified":"2025-05-05T20:27:55Z","title":"Code Injection in froxlor/froxlor","vendor":"froxlor","product":"froxlor/froxlor","tier":"tail","description":{"text":"Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01401,"percentile":0.72475,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://huntr.dev/bounties/7de20f21-4a9b-445d-ae2b-15ade648900b","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8","tags":[]}],"priority":{"score":24.0,"factors":[{"name":"EPSS percentile","points":14.5},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":4.55}]},"exploitSources":{"nuclei":[{"id":"CVE-2022-3869","name":"Froxlor < 0.10.38.2. - HTML Injection","severity":"medium","path":"http/cves/2022/CVE-2022-3869.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3869.yaml"}],"provenance":"source"},"vendorSlug":"froxlor","affectedVersions":[{"vendor":"froxlor","product":"froxlor/froxlor","versions":[">= unspecified, < 0.10.38.2"]}],"affected":[{"ecosystem":"Packagist","package":"froxlor/froxlor","vulnerableRanges":["<0.10.38.2"],"patched":["0.10.38.2"],"from":["GHSA-6rjv-xxgr-v57x"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7260","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-froxlor-froxlor-cve-2022-3017","parents":[{"from":"CVE-2022-3017","to":"CVE-2022-3869","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"0.10.38","toFixed":"0.10.38.2","daysApart":69},{"kind":"same-code","provenance":"machine","files":["lng/english.lng.php","lng/german.lng.php"],"commits":["https://github.com/froxlor/froxlor/commit/bbe82286aae21328668f24857995a67598fe978a","https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-10236","published":"2020-03-09","fixed":"0.10.14","kev":false},{"cve":"CVE-2021-42325","published":"2021-10-12","fixed":"0.10.30","kev":false},{"cve":"CVE-2022-3017","published":"2022-08-28","fixed":"0.10.38","kev":false},{"cve":"CVE-2022-3869","published":"2022-11-05","fixed":"0.10.38.2","kev":false},{"cve":"CVE-2022-3721","published":"2022-11-04","fixed":"0.10.39","kev":false,"link":{"from":"CVE-2022-3869","to":"CVE-2022-3721","relation":"successor","confidence":"high","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"0.10.38.2","toFixed":"0.10.39","daysApart":-1},{"kind":"same-code","provenance":"machine","files":["index.php"],"commits":["https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c","https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2022-4864","published":"2022-12-30","fixed":"2.0.0-beta1","kev":false},{"cve":"CVE-2022-4867","published":"2022-12-31","fixed":"2.0.0-beta1","kev":false}],"package":"Packagist:froxlor/froxlor"}}