{"id":"CVE-2023-3172","published":"2023-06-09T00:00:00Z","modified":"2025-01-06T17:12:23Z","title":"Path Traversal in froxlor/froxlor","vendor":"froxlor","product":"froxlor/froxlor","tier":"tail","description":{"text":"Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01206,"percentile":0.68207,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://huntr.dev/bounties/e50966cd-9222-46b9-aedc-1feb3f2a0b0e","tags":[]},{"url":"https://github.com/froxlor/froxlor/commit/da810ea95393dfaec68a70e30b7c887c50563a7e","tags":[]}],"priority":{"score":18.2,"factors":[{"name":"EPSS percentile","points":13.64},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"froxlor","affectedVersions":[{"vendor":"froxlor","product":"froxlor/froxlor","versions":[">= unspecified, < 2.0.20"]}],"affected":[{"ecosystem":"Packagist","package":"froxlor/froxlor","vulnerableRanges":["<2.0.20"],"patched":["2.0.20"],"from":["GHSA-ghqq-jfx7-f6m9"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1804","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2023-1307","published":"2023-03-10","fixed":"2.0.13","kev":false},{"cve":"CVE-2023-2034","published":"2023-04-14","fixed":"2.0.14","kev":false},{"cve":"CVE-2023-2666","published":"2023-05-12","fixed":"2.0.16","kev":false,"link":{"from":"CVE-2023-2666","to":"CVE-2023-3172","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:froxlor/froxlor","fromFixed":"2.0.16","toFixed":"2.0.20","daysApart":28}]}},{"cve":"CVE-2023-3172","published":"2023-06-09","fixed":"2.0.20","kev":false},{"cve":"CVE-2023-3173","published":"2023-06-09","fixed":"2.0.20","kev":false},{"cve":"CVE-2023-3668","published":"2023-07-14","fixed":"2.0.21","kev":false},{"cve":"CVE-2023-4304","published":"2023-08-11","fixed":"2.0.22","kev":false}],"package":"Packagist:froxlor/froxlor"}}