GHSA-2wjp-w7g7-h63q

thorsten/phpmyfaq vulnerable to improper access control

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-1883

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	thorsten/phpmyfaq	< 3.1.12	3.1.12

Details

As written in the advisory (Markdown source, shown as plain text).

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-1883 advisory
https://github.com/thorsten/phpmyfaq/commit/db77df888178766987398597d4f153831c62a503 web
https://github.com/thorsten/phpMyFAQ package
https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191 web