Lucene search

CVE-2023-22487

🗓️ 11 Jan 2023 20:08:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 89 Views🌐 WEB

Flarum forum software mentions feature vulnerability allows leaking of post details and full JSON:API payload, enabling access to all posts in the forum database

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 7
Prion	Design/Logic Flaw	11 Jan 202320:15	–	prion
Cvelist	CVE-2023-22487 Post mentions can be used to read any post on the forum without access control	11 Jan 202319:49	–	cvelist
Vulnrichment	CVE-2023-22487 Post mentions can be used to read any post on the forum without access control	11 Jan 202319:49	–	vulnrichment
OSV	Flarum post mentions can be used to read any post on the forum without access control	10 Jan 202322:19	–	osv
Veracode	Information Disclosure	22 Jan 202314:22	–	veracode
NVD	CVE-2023-22487	11 Jan 202320:15	–	nvd
Github Security Blog	Flarum post mentions can be used to read any post on the forum without access control	10 Jan 202322:19	–	github

Nvd

Vulners

Node

flarum flarumRange<1.6.3

[
  {
    "vendor": "flarum",
    "product": "framework",
    "versions": [
      {
        "version": "< 1.6.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3
github	www.github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985

Parameter	Position	Path	Description	CWE
mentionsPosts	request body	/api/posts	Leaking full JSON:API payload of all mentioned posts without access control.	CWE-284
mentionsPosts	request body	/api/posts/<id>	Leaking full JSON:API payload of all mentioned posts without access control.	CWE-284

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

11 Jan 2023 20:15Current

4.7Medium risk

Vulners AI Score4.7

CVSS34.3 - 7.7

EPSS0.00066

SSVC

CWE-284