thorsten/phpmyfaq · Security
thorsten/phpmyfaq vulnerable to improper access control
- GHSA ID
- GHSA-2wjp-w7g7-h63q
- CVE ID
- CVE-2023-1883
- Severity
- medium
- Published
- Updated
- CVSS
- 5.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 5.4 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Description
thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.
CWEs
- CWE-284 · Improper Access Control