CVE-2022-41938
published 2022-11-19CVE-2022-41938: Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered…
PriorityP423medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.68%
47.8th percentile
Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flarum | core | >= 1.5.0 < 1.6.2 | 1.6.2 |
| flarum | flarum | >= 1.5.0 < 1.6.2 | 1.6.2 |
| flarum | framework | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross site scripting vulnerability with discussion titles
osv·2022-11-21
CVE-2022-41938 [CRITICAL] Cross site scripting vulnerability with discussion titles
Cross site scripting vulnerability with discussion titles
Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed.
This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page.
### Impact
All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted.
### Patches
The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2 using:
```
composer update --prefer-dist --no-dev -a -W
```
You can then confirm you
GHSA
Cross site scripting vulnerability with discussion titles
ghsa·2022-11-21
CVE-2022-41938 [CRITICAL] CWE-79 Cross site scripting vulnerability with discussion titles
Cross site scripting vulnerability with discussion titles
Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed.
This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page.
### Impact
All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted.
### Patches
The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2 using:
```
composer update --prefer-dist --no-dev -a -W
```
You can then confirm you
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.flarum.org/d/27558https://github.com/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854xhttps://discuss.flarum.org/d/27558https://github.com/flarum/framework/commit/690de9ce0ffe7ac4d45b73e303f44340c3433138https://github.com/flarum/framework/security/advisories/GHSA-7x4w-j98p-854x
2022-11-19
Published