PT-2022-26169 · Flarum · Flarum

Dangzed · Published 2022-11-19 · Updated 2022-11-26 · CVE-2022-41938

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flarum versions 1.5.0 through 1.6.1

Description The issue arises from Flarum's page title system, which allowed page titles to be converted into HTML DOM nodes when pages were rendered. This enabled an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The attack occurs after a visitor opens the relevant discussion page. All communities running the affected versions are impacted.

Recommendations For versions 1.5.0 through 1.6.1, upgrade to version 1.6.2 as soon as possible. To upgrade, use the command composer update --prefer-dist --no-dev -a -W, and then confirm the latest version using composer show flarum/core.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41938

GHSA-7X4W-J98P-854X

Affected Products

Flarum

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41938.json · Exploit
• https://github.com/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138 · Patch
• https://discuss.flarum.org/d/27558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41938 · Security Note
• https://osv.dev/vulnerability/GHSA-7x4w-j98p-854x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41938 · Vendor Advisory
• https://github.com/flarum/framework · Note
• https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854x · Note