Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-22489— Flarum is missing authorization in discussion replies

Quick assessment

Affected
flarum framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Flarum是Flarum社区的一套开源的论坛系统。 Flarum v1.6.3之前版本存在安全漏洞，该漏洞源于会打开不受控制的垃圾邮件或无意回复的讨论。

CVSS 3.5 · Low EPSS 0.56% · P44
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-22489

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Flarum is missing authorization in discussion replies
Source: CVE Program / CVE List V5
Vulnerability Description
Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that don't have a validated email. Guests cannot successfully create a reply because the API will fail with a 500 error when the user ID 0 is inserted into the database. This happens because when the first post of a discussion is permanently deleted, the `first_post_id` attribute of the discussion becomes `null` which causes access control to be skipped for all new replies. Flarum automatically makes discussions with zero comments invisible so an additional condition for this vulnerability is that the discussion must have at least one approved reply so that `discussions.comment_count` is still above zero after the post deletion. This can open the discussion to uncontrolled spam or just unintentional replies if users still had their tab open before the vulnerable discussion was locked and then post a reply when they shouldn't be able to. In combination with the email notification settings, this could also be used as a way to send unsolicited emails. Versions between `v1.3.0` and `v1.6.3` are impacted. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible. There are no known workarounds.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Flarum 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Flarum是Flarum社区的一套开源的论坛系统。 Flarum v1.6.3之前版本存在安全漏洞，该漏洞源于会打开不受控制的垃圾邮件或无意回复的讨论。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
flarum framework >= 1.3.0, < 1.6.3 -

II. Public POCs for CVE-2023-22489

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-22489

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-22489 (1)

Vendor Advisories for CVE-2023-22489 (1)

Other References for CVE-2023-22489 (1)

IV. Related Vulnerabilities

Same product: framework
Same vendor: flarum
Same weakness: CWE-862

V. Comments for CVE-2023-22489

No comments yet

Leave a comment