CVE-2019-13183: CSRF
Published Jul 7, 2019
·Updated
Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.
Affected Software
12 affected components
Flarum Flarum=0.1.0
Flarum Flarum=0.1.0-beta2
Flarum Flarum=0.1.0-beta3
Flarum Flarum=0.1.0-beta4
Flarum Flarum=0.1.0-beta5
Flarum Flarum=0.1.0-beta6
Flarum Flarum=0.1.0-beta7
Flarum Flarum=0.1.0-beta7.1
Flarum Flarum=0.1.0-beta7.2
Flarum Flarum=0.1.0-beta8
Flarum Flarum=0.1.0-beta8.1
Flarum Flarum=0.1.0-beta8.2
Event History
Jul 7, 2019
CVE Published
via MITRE·02:34 PM
Data Sourced
via MITRE·02:34 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-13183?
CVE-2019-13183 is considered a high severity vulnerability due to its ability to allow cross-site request forgery (CSRF) attacks against all POST endpoints.
2
How do I fix CVE-2019-13183?
To fix CVE-2019-13183, you should upgrade to Flarum version 0.1.0-beta.9 or later.
3
What impact does CVE-2019-13183 have on my Flarum installation?
CVE-2019-13183 can allow unauthorized users to change admin settings, which compromises the integrity of your Flarum application.
4
Which versions of Flarum are affected by CVE-2019-13183?
CVE-2019-13183 affects Flarum versions 0.1.0 to 0.1.0-beta.8.
5
Is there a known exploit for CVE-2019-13183?
Yes, CVE-2019-13183 has been demonstrated to allow CSRF attacks, specifically through changing admin settings.