PT-2024-40494 · Unknown · Forum Module

Published 2024-05-23 · Updated 2024-05-23

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Forum module (affected versions not specified)

Description The issue allows malicious users, such as spammers, to create members and post to forums using GET requests, bypassing CSRF and anti-spam measures. Additionally, a forum moderator can be tricked into clicking a specially crafted URL, resulting in a topic being moved.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-425

CWE-352

Related Identifiers

GHSA-W8FQ-XGVH-CXC2

Affected Products

Forum Module

References · 6

• https://osv.dev/vulnerability/GHSA-w8fq-xgvh-cxc2 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/forum/SS-2015-017-1.yaml · Note
• https://github.com/silverstripe-archive/silverstripe-forum/commit/0ec7c92785f36c8edf4a11c36a4fc27e0c40cee6 · Note
• https://github.com/silverstripe-archive/silverstripe-forum/commit/efe09f95ccdb0138ce5bd3d3a21b3d9e97038dd8 · Note
• https://github.com/silverstripe-archive/silverstripe-forum · Note
• https://silverstripe.org/software/download/security-releases/ss-2015-017 · Note