PT-2022-23027 · Unknown+2 · Flarum Core+2

Lowdavwheat · Published 2022-08-01 · Updated 2023-07-21 · CVE-2022-35921

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions fof/byobu versions prior to 1.1.7

Description The issue concerns the fof/byobu private discussions extension for Flarum forum, where affected versions do not respect private discussion disablement by users. This means users who have chosen to prevent others from starting private discussions with them may still be affected. However, admins and others with appropriate permissions can always bypass this preference. There are no workarounds for this issue.

Recommendations To resolve the issue, update the fof/byobu extension to version 1.1.7, which is only supported on Flarum Core version 1.2.0 and later. For users of Byobu with Flarum 1.0 or 1.1, upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2022-35921

GHSA-6GJM-6WJ6-4PX5

Affected Products

Flarum

Flarum Core

Fof/Byobu

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35921.json · Exploit
• https://github.com/FriendsOfFlarum/byobu/commit/23dcf93a30f948d30c678a96681f7fdefeba5171 · Patch
• https://osv.dev/vulnerability/CVE-2022-35921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35921 · Security Note
• https://osv.dev/vulnerability/GHSA-6gjm-6wj6-4px5 · Vendor Advisory
• https://github.com/FriendsOfFlarum/byobu · Note
• https://github.com/FriendsOfFlarum/byobu/security/advisories/GHSA-6gjm-6wj6-4px5 · Note
• https://t.me/cibsecurity/47395 · Telegram Post