Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2023-22487

7.7 · HIGH

Flarum is a forum software for building communities.

Published Jan 11, 2023CWE-284EPSS 0.66%

Overview

CVE-2023-22487 is a high-severity vulnerability. It was published on January 11, 2023 and has a CVSS 3.1 base score of 7.7 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.7, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical description

Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hid

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

GitHubgithub.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985GitHubgithub.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3GitHubgithub.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985GitHubgithub.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3

How CyberStrike helps

Frequently asked questions

What is CVE-2023-22487?

CVE-2023-22487 is a high-severity vulnerability. It was published on January 11, 2023 and has a CVSS 3.1 base score of 7.7 (HIGH).

How severe is CVE-2023-22487?

This vulnerability has a CVSS 3.1 base score of 7.7, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2023-22487?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2023-22487?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2023-22487 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2023

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999