GHSA-2wjp-w7g7-h63q

ghsaUSosv

thorsten/phpmyfaq vulnerable to improper access control

view advisory published 2023-04-05Licence: CC-BY-4.0

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-1883US	medium5.4	0.49% (42nd)	—	2023-04-05
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

references

External citations — patches, advisories, analysis.

https://github.com/thorsten/phpMyFAQPACKAGE
https://github.com/thorsten/phpmyfaq/commit/db77df888178766987398597d4f153831c62a503WEB
https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-1883ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan