Email Token Invalidation Flaw in Flarum by Flarum
CVE-2019-11514

7.5HIGH

Key Information:

Vendor

Flarum

Status
Flarum
Vendor
CVE Published:
25 April 2019

What is CVE-2019-11514?

A flaw in the User/Command/ConfirmEmailHandler.php component of Flarum versions prior to 0.1.0-beta.8 leads to improper handling of user email token invalidation. This vulnerability can potentially allow unauthorized users to exploit shortcomings in email token management, posing risks to user account security. Developers utilizing affected versions are advised to update to the latest release to mitigate these risks.

References

https://github.com/flarum/core/commit/66607a56749339d5062...
x_refsource_MISC
https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-re...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.