CVE-2020-10235

Name: CVE-2020-10235
Creator: NVD / NIST
Published: 2020-03-09T16:15:12.047+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 1.68%

Last modified Jun 17, 2026

CVE-2020-10235 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.. EPSS estimates a 1.68% chance of exploitation in the next 30 days.

Description

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.68%

74.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Froxlor	Froxlor	< 0.10.14

References

https://bugzilla.suse.com/show_bug.cgi?id=1165721Exploit, Issue Tracking, Third Party Advisory
https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656Patch
https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207Patch
https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14Patch
https://bugzilla.suse.com/show_bug.cgi?id=1165721Exploit, Issue Tracking, Third Party Advisory
https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656Patch
https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207Patch
https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14Patch

Timeline

Published: Mar 9, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-10235?

How severe is CVE-2020-10235?

CVE-2020-10235 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.68% probability of exploitation in the next 30 days.

How do I fix CVE-2020-10235?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-10235?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST