FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

froxlor -- database password information leak

Affected packages
froxlor <


VuXML ID 9ee72858-4159-11e5-93ad-002590263bf5
Discovery 2015-07-29
Entry 2015-08-13 reports:

An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file. This directory is publicly reachable under the default configuration/setup.

Note that froxlor prevents future logging of passwords but does not retroactively remove passwords already logged. Michael Kaufmann, the Froxlor lead developer reports:

Removing all .log files from the directory should do the job, alternatively just use the class.ConfigIO.php from Github


CVE Name CVE-2015-5959
FreeBSD PR ports/202262