CVE-2019-11514 : User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles in

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.

Published 2019-04-25 03:29:00

Updated 2020-08-24 17:37:01

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-11514

Flarum » Flarum » Version: 0.1.0 Update Beta4
cpe:2.3:a:flarum:flarum:0.1.0:beta4:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta2
cpe:2.3:a:flarum:flarum:0.1.0:beta2:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta7.2
cpe:2.3:a:flarum:flarum:0.1.0:beta7.2:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta7.1
cpe:2.3:a:flarum:flarum:0.1.0:beta7.1:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta7
cpe:2.3:a:flarum:flarum:0.1.0:beta7:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta6
cpe:2.3:a:flarum:flarum:0.1.0:beta6:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta
cpe:2.3:a:flarum:flarum:0.1.0:beta:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0
cpe:2.3:a:flarum:flarum:0.1.0:-:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta5
cpe:2.3:a:flarum:flarum:0.1.0:beta5:*:*:*:*:*:*
Matching versions
Flarum » Flarum » Version: 0.1.0 Update Beta3
cpe:2.3:a:flarum:flarum:0.1.0:beta3:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-459 Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Assigned by: nvd@nist.gov (Primary)

https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7

Always invalidate all user email tokens · flarum/core@66607a5 · GitHub
Patch;Third Party Advisory
https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released

Flarum 0.1.0-beta.8 Released - Flarum Community
Third Party Advisory

Jump to