CVE-2022-24865: Improper access control in humhub
HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit eb83de20. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-24865?
CVE-2022-24865 is a vulnerability in the HumHub Open Source Enterprise Social Network that allows users who are forced to change their password by an administrator to retrieve other users' data.
How can I check if my version of HumHub is affected by CVE-2022-24865?
You can check if your version of HumHub is affected by CVE-2022-24865 by verifying if it is running a version between 1.10.0 (inclusive) and 1.10.4 (exclusive), or if it is running version 1.9.4 or earlier.
How can I fix CVE-2022-24865?
To fix CVE-2022-24865, it is recommended to upgrade HumHub to version 1.11.0, 1.10.4, or 1.9.4.
What is the severity of CVE-2022-24865?
CVE-2022-24865 has a severity value of 6.5, which is classified as medium severity.
Where can I find more information about CVE-2022-24865?
You can find more information about CVE-2022-24865 in the references provided: [GitHub commit](https://github.com/humhub/humhub/commit/eb83de20aaecc559ab77a44a6179646a99607e33), [GitHub security advisory](https://github.com/humhub/humhub/security/advisories/GHSA-2h35-f226-3f57), [Huntr bounty](https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76/).