CyberSec.Space Logo
Back to CVE Browser

CVE-2019-11514

HIGH
7.5
CVSS Severity Score
EPSS Score0.1850%
EPSS Percentile9.00th
PublishedApr 25, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.

Affected Platforms (CPE)

📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0
📦
Flarum

Flarum

= 0.1.0

References & Advisories

🔗 https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released
🔗 https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7
🔗 https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released
🔗 https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7

Related Vulnerabilities

CVE-2021-3267110.0

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HT...

CVE-2019-131838.8

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

CVE-2021-212835.4

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 ...

CVE-2018-191335.3

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.