CVE-2023-22487

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22487", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-12-29T17:41:28.089Z", "datePublished": "2023-01-11T19:49:37.668Z", "dateUpdated": "2025-03-10T21:30:35.411Z"}, "containers": {"cna": {"title": "Post mentions can be used to read any post on the forum without access control", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3"}, {"name": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985", "tags": ["x_refsource_MISC"], "url": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985"}], "affected": [{"vendor": "flarum", "product": "framework", "versions": [{"version": "< 1.6.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-11T19:49:37.668Z"}, "descriptions": [{"lang": "en", "value": "Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@\"<username>\"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward. The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events. The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown. All Flarum versions prior to 1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. As a workaround, user can disable the mentions extension."}], "source": {"advisory": "GHSA-22m9-m3ww-53h3", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.533Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3"}, {"name": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T21:01:41.331652Z", "id": "CVE-2023-22487", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:30:35.411Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3", "name": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985", "name": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:48.533Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22487", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T21:01:41.331652Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:01:42.555Z"}}], "cna": {"title": "Post mentions can be used to read any post on the forum without access control", "source": {"advisory": "GHSA-22m9-m3ww-53h3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "flarum", "product": "framework", "versions": [{"status": "affected", "version": "< 1.6.3"}]}], "references": [{"url": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3", "name": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985", "name": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@\"<username>\"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward. The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events. The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown. All Flarum versions prior to 1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. As a workaround, user can disable the mentions extension."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-01-11T19:49:37.668Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22487", "state": "PUBLISHED", "dateUpdated": "2025-03-10T21:30:35.411Z", "dateReserved": "2022-12-29T17:41:28.089Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-01-11T19:49:37.668Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "framework", "vendor": "flarum", "versions": [{"status": "affected", "version": "< 1.6.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flarum:flarum:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CCA0BF4-79A3-4528-821A-DF5DB8692C99", "versionEndExcluding": "1.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flarum is a forum software for building communities. Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@\"<username>\"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward. The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events. The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown. All Flarum versions prior to 1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. As a workaround, user can disable the mentions extension."}, {"lang": "es", "value": "Flarum es un software de foro para construir comunidades. Usando la funci\u00f3n de menciones proporcionada por la extensi\u00f3n flarum/mentions, los usuarios pueden mencionar cualquier ID de publicaci\u00f3n en el foro con la sintaxis especial `@\"\"#p`. El siguiente comportamiento nunca cambia, sin importar si el actor deber\u00eda poder leer la publicaci\u00f3n mencionada o no: se inserta una URL a la publicaci\u00f3n mencionada en el HTML de la publicaci\u00f3n del actor, filtrando su ID de discusi\u00f3n y n\u00famero de publicaci\u00f3n. La relaci\u00f3n `mentionsPosts` incluida en las respuestas JSON `POST /api/posts` y `PATCH /api/posts/` filtra el payload JSON:API completa de todas las publicaciones mencionadas sin ning\u00fan control de acceso. Esto incluye el contenido, la fecha, el n\u00famero y los atributos agregados por otras extensiones. Un atacante s\u00f3lo necesita la capacidad de crear nuevas publicaciones en el foro para explotar la vulnerabilidad. Esto funciona incluso si las nuevas publicaciones requieren aprobaci\u00f3n. Si tienen la capacidad de editar publicaciones, el ataque se puede realizar de manera a\u00fan m\u00e1s discreta usando una sola publicaci\u00f3n para escanear cualquier tama\u00f1o de base de datos y ocultando el contenido de la publicaci\u00f3n del ataque luego. El ataque permite la filtraci\u00f3n de todas las publicaciones en la base de datos del foro, incluidas las publicaciones en espera de aprobaci\u00f3n, las publicaciones en etiquetas a las que el usuario no tiene acceso y las discusiones privadas creadas por otras extensiones como FriendsOfFlarum Byobu. Esto tambi\u00e9n incluye publicaciones que no son comentarios, como cambios de etiquetas o cambios de nombre de eventos. El payload de la discusi\u00f3n no se filtra, pero utilizando el payload HTML de menci\u00f3n es posible extraer el ID de la discusi\u00f3n de todas las publicaciones y combinar todas las publicaciones nuevamente en sus discusiones originales, incluso si el t\u00edtulo de la discusi\u00f3n sigue siendo desconocido. Todas las versiones de Flarum anteriores a la 1.6.3 se ven afectadas. La vulnerabilidad ha sido reparada y publicada como flarum/core v1.6.3. Como workaround, el usuario puede desactivar la extensi\u00f3n de menciones."}], "id": "CVE-2023-22487", "lastModified": "2026-06-17T05:35:34.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-22487", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-10T21:01:41.331652Z", "version": "2.0.3"}}]}, "published": "2023-01-11T20:15:08.833", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/flarum/framework/commit/ab1c868b978e8b0d09a5d682c54665dae17d0985"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/flarum/framework/security/advisories/GHSA-22m9-m3ww-53h3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}