CVE-2024-58383
Received Received - Intake

Information Disclosure in Froxlor via Insecure File Permissions

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2024-58383
EUVD
EUVD-2024-55764

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
froxlor froxlor to 2.2.0-rc3 (exc)
froxlor froxlor to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Froxlor before 2.2.0 creates /etc/pure-ftpd/db/mysql.conf with insecure permissions (0644), exposing the Froxlor SQL user's password. This file is readable by any local user on systems with world-readable parent directories, such as Debian 12 by default. Attackers can exploit this to obtain database credentials and escalate privileges to root.

Detection Guidance

Check the permissions of /etc/pure-ftpd/db/mysql.conf with 'ls -l /etc/pure-ftpd/db/mysql.conf'. If it shows permissions 0644 and the file contains plaintext MySQL credentials, the system is vulnerable. Also verify if parent directories like /etc/pure-ftpd/db are world-readable with 'ls -ld /etc/pure-ftpd/db'.

Impact Analysis

If you use Froxlor versions before 2.2.0 with pure-ftpd on Debian 12 or similar systems, an attacker with local access or code execution ability (even via PHP scripts) can read the mysql.conf file. This allows them to steal database credentials, log in as a Froxlor administrator, and gain root privileges by manipulating admin accounts or cron jobs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of database credentials may result in data breaches, non-compliance penalties, and loss of trust due to inadequate security controls.

Mitigation Strategies

Update Froxlor to version 2.2.0 or later immediately. If updating is not possible, restrict file permissions to 0600 with 'chmod 600 /etc/pure-ftpd/db/mysql.conf' and ensure parent directories are not world-readable. Alternatively, configure MySQL to use passwordless unix socket authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart