FreedomBox up to and including 20.13 allows remote malicious users to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, but only if the Apache mod_status module is enabled.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
debian freedombox |
Vulmon