CVE-2022-41938: Cross site scripting vulnerability with discussion titles in flarum
Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. All communities running Flarum from v1.5.0 to v1.6.1 are impacted. The vulnerability has been fixed and published as flarum/core v1.6.2. All communities running Flarum from v1.5.0 to v1.6.1 have to upgrade as soon as possible to v1.6.2. There are no known workarounds for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flarum/coreto a version that resolves this vulnerability.Fixed in v1.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41938?
CVE-2022-41938 has a moderate severity rating due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2022-41938?
To fix CVE-2022-41938, update your Flarum installation to version 1.6.2 or later.
What software is affected by CVE-2022-41938?
CVE-2022-41938 affects Flarum versions from 1.5.0 up to, but not including, 1.6.2.
What is the nature of the vulnerability in CVE-2022-41938?
CVE-2022-41938 allows attackers to inject malicious HTML through the page title system.
Can CVE-2022-41938 be exploited remotely?
Yes, an attacker can exploit CVE-2022-41938 remotely if they can manipulate the page titles of the affected Flarum installations.