CVE-2026-62988

{
  "id": "CVE-2026-62988",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T21:17:18.077",
  "lastModified": "2026-11-09T20:10:00.200",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8."
    },
    {
      "lang": "es",
      "value": "Froxlor es software de administración de servidor de código abierto. Desde 2.3.7 hasta 2.3.8, los comandos API Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get y Ftps.listing en lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php y lib/Froxlor/Api/Commands/Ftps.php recuperan filas completas de la base de datos y las devuelven sin eliminar los campos de contraseña y data_2fa. Un llamador de API autenticado con permiso para usar estos puntos finales puede obtener hashes de contraseña de clientes, administradores y FTP, así como semillas TOTP codificadas en Base32 para cuentas de administrador y cliente. Los hashes de contraseña pueden ser descifrados sin conexión, y las semillas TOTP pueden generar códigos de segundo factor válidos hasta que se restablezca la autenticación de dos factores. La exposición de ambos valores para una cuenta puede permitir la toma de control del panel de alojamiento o de los recursos alojados y puede anular ambos factores de autenticación. Este problema está solucionado en la versión 2.3.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "froxlor",
          "product": "froxlor",
          "versions": [
            {
              "version": "< 2.3.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T19:12:49.110502Z",
          "id": "CVE-2026-62988",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/froxlor/froxlor/commit/52a43fb826bb9a058faf9c39feeef7ac4444ceba",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/froxlor/froxlor/commit/8667fa3a4d77d6e322b7b8f7b9edbc1613ab5797",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/froxlor/froxlor/releases/tag/2.3.8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}