CVE-2022-41938: Cross-Site Scripting Vulnerability in Flarum/Core
Summary
CVE-2022-41938: Cross site scripting vulnerability with discussion titles. Affects flarum/core versions >= 1.5.0, < 1.6.2. Fixed in 1.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flarum/Core is an open-source software package used for building online communities. It provides various features and functionalities for managing discussions, user interactions, and content. Flarum/Core versions 1.5.0 to 1.6.1 are affected by a cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The XSS vulnerability in Flarum/Core arises from the system's page title conversion process. In versions 1.5.0 to 1.6.1, page titles were converted into HTML DOM nodes during rendering. This change went unnoticed and allowed attackers to inject malicious HTML markup using discussion title inputs. The XSS attack occurs when a visitor opens the relevant discussion page. This vulnerability has a CVSS score of 9.0, indicating a critical severity level.
How To Fix
Minimum fixed version
1.6.2
This is the first release that contains the fix.
composer require flarum/core:1.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workarounds are available for this vulnerability. Upgrading to Flarum/Core version 1.6.2 is the recommended solution.
Conclusion
Flarum/Core versions 1.5.0 to 1.6.1 are vulnerable to a critical cross-site scripting (XSS) issue. To mitigate this vulnerability, community administrators should upgrade to version 1.6.2. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for flarum/core →
FAQ
Flarum/Core is an open-source software package used for building online communities. It provides features for managing discussions, user interactions, and content.
Versions 1.5.0 to 1.6.1 of Flarum/Core are affected.
The vulnerability allows attackers to inject malicious HTML markup using discussion title inputs, potentially leading to cross-site scripting attacks on visitors of affected Flarum communities.
To fix this vulnerability, upgrade your Flarum/Core installation to version 1.6.2 using the provided command.
No, there are no workarounds available for this vulnerability. Upgrading to version 1.6.2 is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for flarum/core.
