CVE-2023-22489

2023-01-1319:15:12

CWE-862

[email protected]

web.nvd.nist.gov

flarum

discussion platform

cve-2023-22489

security vulnerability

api

unauthenticated users

email notification

access control

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

3.9 Low

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.3%

JSON

Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that don’t have a validated email. Guests cannot successfully create a reply because the API will fail with a 500 error when the user ID 0 is inserted into the database. This happens because when the first post of a discussion is permanently deleted, the first_post_id attribute of the discussion becomes null which causes access control to be skipped for all new replies. Flarum automatically makes discussions with zero comments invisible so an additional condition for this vulnerability is that the discussion must have at least one approved reply so that discussions.comment_count is still above zero after the post deletion. This can open the discussion to uncontrolled spam or just unintentional replies if users still had their tab open before the vulnerable discussion was locked and then post a reply when they shouldn’t be able to. In combination with the email notification settings, this could also be used as a way to send unsolicited emails. Versions between v1.3.0 and v1.6.3 are impacted. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible. There are no known workarounds.

Affected configurations

Vulners

NVD

Node

flarumflarumRange1.3.0–1.6.3

VendorProductVersionCPE
flarumflarum*cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
flarum	flarum	*	cpe:2.3:a:flarum:flarum::::::::

CNA Affected

[
  {
    "vendor": "flarum",
    "product": "framework",
    "versions": [
      {
        "version": ">= 1.3.0, < 1.6.3",
        "status": "affected"
      }
    ]
  }
]