CVE-2024-58383
Froxlor before 2.2.0 Insecure File Permissions mysql.conf
Description
Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.
INFO
Published Date :
Sept. 14, 2026, 1:17 p.m.
Last Modified :
Oct. 27, 2026, 11:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Froxlor to version 2.2.0 or newer.
- Review and secure parent directory permissions.
- Consider restricting access to sensitive configuration files.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-58383.
| URL | Resource |
|---|---|
| https://github.com/froxlor/froxlor/security/advisories/GHSA-34qg-65m4-f23m | |
| https://www.vulncheck.com/advisories/froxlor-before-2.2.0-insecure-file-permissions-mysql-conf |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-58383 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-58383
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-58383 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-58383 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 27, 2026
Action Type Old Value New Value Added Translation Title: Froxlor, Description: Froxlor antes de la versión 2.2.0 (afectado hasta la versión 2.2.0-rc3 incluida) genera /etc/pure-ftpd/db/mysql.conf con modo 0644 mediante las plantillas de configuración XML en lib/configfiles/, aunque el archivo contiene la contraseña del usuario SQL de Froxlor. En sistemas donde los directorios padre son legibles por todos (el valor predeterminado en Debian 12), cualquier usuario local sin privilegios que pueda ejecutar comandos o código en el host - incluidos los usuarios virtuales sin acceso SSH que pueden subir scripts PHP/CGI - puede leer el archivo y obtener las credenciales de la base de datos de Froxlor. El acceso a la base de datos puede entonces aprovecharse para alterar el hash de la contraseña de un administrador y la semilla TOTP, iniciar sesión como administrador de Froxlor y, en última instancia, obtener privilegios de root. Sólo las instancias configuradas para usar pure?ftpd se ven afectadas. -
CVE Modified by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/58xxx/CVE-2024-58383.json">CVE-2024-58383</a> -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 20, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2024-58383', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-09-20T00:13:08.183938Z'} -
New CVE Received by [email protected]
Sep. 14, 2026
Action Type Old Value New Value Added Description Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Added CWE CWE-732 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/58xxx/CVE-2024-58383.json">CVE-2024-58383</a> Added Reference https://github.com/froxlor/froxlor/security/advisories/GHSA-34qg-65m4-f23m Added Reference https://www.vulncheck.com/advisories/froxlor-before-2.2.0-insecure-file-permissions-mysql-conf