https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 20 Aug 2026 20:49:52 +0000 https://vulnerability.circl.lu/sighting/d0917a0b-a1a5-4e06-b410-308e610e3f94/export {"uuid": "d0917a0b-a1a5-4e06-b410-308e610e3f94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xpr4-8vp6-c87j", "type": "seen", "source": "https://gist.github.com/alon710/3948341428804c685cf1bc5b4fc0d3f1", "content": "# CVE-2026-55593: CVE-2026-55593: Persistent Administrative Hijacking via Cross-Site Request Forgery in Froxlor Ajax Router\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55593\n\n## Summary\nFroxlor prior to version 2.3.8 contains a high-severity architectural flaw where the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php. Unauthenticated remote attackers can leverage Cross-Site Request Forgery (CSRF) to induce authenticated administrators to submit forged requests that modify API key whitelists and expiration dates, potentially yielding persistent, out-of-band administrative control.\n\n## TL;DR\nAn architectural flaw in Froxlor's standalone AJAX handler allows remote attackers to perform Cross-Site Request Forgery (CSRF) attacks to silently alter administrative API key parameters and gain persistent, unauthorized server access.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-352 (Cross-Site Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.5 Medium\n- **EPSS Score**: Not available\n- **Impact**: High Integrity Modification (I:H)\n- **Exploit Status**: Proof of Concept / Technical Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Froxlor Server Administration Panel\n- **Froxlor**: < 2.3.8 (Fixed in: `2.3.8`)\n\n## Mitigation\n\n- Upgrade Froxlor to version 2.3.8 or higher.\n- Configure modern SameSite cookie flags (Lax or Strict) on session identifiers.\n- Enforce network segmentation limiting access to administrative endpoints.\n\n**Remediation Steps:**\n1. Retrieve the latest repository updates or download Froxlor v2.3.8 directly from the official source.\n2. Apply the database and file system migrations to update the underlying dependencies and configurations.\n3. Verify that the 'csrf_token' field is properly generated within user sessions.\n4. Inspect browser cookie settings to confirm SameSite cookies are active.\n\n## References\n\n- [Froxlor Security Advisory](https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j)\n- [Code Fix Security Patch Commit](https://github.com/froxlor/froxlor/commit/5f540fe361e7e13e8c5a32805b793a25e9e26a0e)\n- [Froxlor Release 2.3.8](https://github.com/froxlor/froxlor/releases/tag/2.3.8)\n- [CVE-2026-55593 Record](https://www.cve.org/CVERecord?id=CVE-2026-55593)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55593) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T11:32:39.287441Z"} {"uuid": "d0917a0b-a1a5-4e06-b410-308e610e3f94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xpr4-8vp6-c87j", "type": "seen", "source": "https://gist.github.com/alon710/3948341428804c685cf1bc5b4fc0d3f1", "content": "# CVE-2026-55593: CVE-2026-55593: Persistent Administrative Hijacking via Cross-Site Request Forgery in Froxlor Ajax Router\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55593\n\n## Summary\nFroxlor prior to version 2.3.8 contains a high-severity architectural flaw where the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php. Unauthenticated remote attackers can leverage Cross-Site Request Forgery (CSRF) to induce authenticated administrators to submit forged requests that modify API key whitelists and expiration dates, potentially yielding persistent, out-of-band administrative control.\n\n## TL;DR\nAn architectural flaw in Froxlor's standalone AJAX handler allows remote attackers to perform Cross-Site Request Forgery (CSRF) attacks to silently alter administrative API key parameters and gain persistent, unauthorized server access.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-352 (Cross-Site Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.5 Medium\n- **EPSS Score**: Not available\n- **Impact**: High Integrity Modification (I:H)\n- **Exploit Status**: Proof of Concept / Technical Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Froxlor Server Administration Panel\n- **Froxlor**: < 2.3.8 (Fixed in: `2.3.8`)\n\n## Mitigation\n\n- Upgrade Froxlor to version 2.3.8 or higher.\n- Configure modern SameSite cookie flags (Lax or Strict) on session identifiers.\n- Enforce network segmentation limiting access to administrative endpoints.\n\n**Remediation Steps:**\n1. Retrieve the latest repository updates or download Froxlor v2.3.8 directly from the official source.\n2. Apply the database and file system migrations to update the underlying dependencies and configurations.\n3. Verify that the 'csrf_token' field is properly generated within user sessions.\n4. Inspect browser cookie settings to confirm SameSite cookies are active.\n\n## References\n\n- [Froxlor Security Advisory](https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j)\n- [Code Fix Security Patch Commit](https://github.com/froxlor/froxlor/commit/5f540fe361e7e13e8c5a32805b793a25e9e26a0e)\n- [Froxlor Release 2.3.8](https://github.com/froxlor/froxlor/releases/tag/2.3.8)\n- [CVE-2026-55593 Record](https://www.cve.org/CVERecord?id=CVE-2026-55593)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55593) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T11:32:39.287441Z"} https://vulnerability.circl.lu/sighting/d0917a0b-a1a5-4e06-b410-308e610e3f94/export Wed, 19 Aug 2026 11:32:39 +0000