Lucene search
Veracode Vulnerability DatabaseVERACODE:38958HistoryJan 22, 2023 - 2:22 p.m.
Information Disclosure
2023-01-2214:22:18
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
flarum
information disclosure
json
access control
0.001 Low
EPSS
Percentile
20.1%
Flarum is vulnerable to Information Disclosure. The vulnerability exists because the library’s JSON responses leak the complete payload of all mentioned posts without any access control, including post contents when a post includes a payload such as @""#p.
| CPE | Name | Operator | Version |
|---|---|---|---|
| flarum/mentions | le | v1.6.1 | |
| flarum/framework | le | v1.6.2 | |
| flarum/mentions | le | v1.6.1 | |
| flarum/framework | le | v1.6.2 |
References
github.com/flarum/framework/commit/132fdea659754ef57b7e3eb4b28c957cca06c9c5
github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985
github.com/flarum/framework/pull/3721
github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3
github.com/flarum/mentions/commit/69ad759248728560d6c1981a495bdb5173da2d0b
Related
cve
cve
CVE-2023-22487
2023-01-11 20:15:08
prion
prion
Design/Logic Flaw
2023-01-11 20:15:00
osv
osv
nvd
nvd
CVE-2023-22487
2023-01-11 20:15:08
cvelist
cvelist
github
github