GitHub Advisoryadvisory · Packagist

GHSA-g6w5-439m-jhwv Flarum mishandles invalidation of user email tokens

HIGH Published 2022-05-24 Modified 2024-04-25 Official page ↗

Aliases: CVE-2019-11514
Ecosystem: Packagist
Packages: flarum/flarum
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses: CWE-459
Reviewed: 2024-04-25

Affected packages

• Packagist flarum/flarum: < 0.1.0-beta.8 → fixed in 0.1.0-beta.8

Description

`User/Command/ConfirmEmailHandler.php` in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.

Related

Alias · CVE (1)

CVE-2019-11514 User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. vulnerability

Weakness · CWE (1)

CWE-459 Incomplete Cleanup weakness

References