GitHub Advisoryadvisory · Packagist

GHSA-2wjp-w7g7-h63q thorsten/phpmyfaq vulnerable to improper access control

MEDIUM Published 2023-04-05 Modified 2023-04-06 Official page ↗
Aliases
CVE-2023-1883
Ecosystem
Packagist
Packages
thorsten/phpmyfaq
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2023-04-06

Affected packages

• Packagist thorsten/phpmyfaq: < 3.1.12 → fixed in 3.1.12

Description

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.

Related

Alias · CVE (1)

  • CVE-2023-1883 Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References