CVE-2022-4868 (published 2022-12-31T10:15Z)

Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-285
cwe_name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/froxlor/froxlor
commit_details: repo_url: https://github.com/froxlor/froxlor
author: Michael Kaufmann
author_date: 2022-12-31 00:42:58+01:00
msg: dont show page content for resellers withouth required permissions to actually do something

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
repository: repo_url: https://github.com/froxlor/froxlor
repo_name: froxlor/Froxlor
description: The server administration software for your needs - The official Froxlor development Git repository
repo_language: PHP
owner: froxlor
file_changes: filename: admin_cronjobs.php
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ use Froxlor\UI\Response;
 
 $id = (int)Request::any('id');
 
-if ($page == 'cronjobs' || $page == 'overview') {
+if (($page == 'cronjobs' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
 	if ($action == '') {
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, 'viewed admin_cronjobs');
 

programming_language: PHP
filename: admin_ipsandports.php
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ use Froxlor\UI\Response;
 
 $id = (int)Request::any('id');
 
-if ($page == 'ipsandports' || $page == 'overview') {
+if (($page == 'ipsandports' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
 	if ($action == '') {
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, "viewed admin_ipsandports");
 

programming_language: PHP
filename: admin_mysqlserver.php
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ use Froxlor\UI\Response;
 
 $id = (int)Request::any('id');
 
-if ($page == 'mysqlserver' || $page == 'overview') {
+if (($page == 'mysqlserver' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
 	if ($action == '') {
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, "viewed admin_mysqlserver");
 

programming_language: PHP
filename: IpsAndPorts.php
change_type: ModificationType.MODIFY
diff: @@ -391,7 +391,7 @@ class IpsAndPorts extends ApiCommand implements ResourceEntity
 	 */
 	public function update()
 	{
-		if ($this->isAdmin() && ($this->getUserDetail('change_serversettings') || !empty($this->getUserDetail('ip')))) {
+		if ($this->isAdmin() && $this->getUserDetail('change_serversettings')) {
 			$id = $this->getParam('id');
 
 			$result = $this->apiCall('IpsAndPorts.get', [

programming_language: PHP