GHSA-w8fq-xgvh-cxc2 — Silverstripe Forum Module CSRF Vulnerability

The advisory, in context

A number of form actions in the Forum module are directly accessible. A malicious user (e.g. spammer) can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures.

Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting in a topic being moved.

Thanks to Michael Strong for discovering.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

silverstripe/forum Packagist

Ecosystem versions

Earlier releases before 0.6.2

Fixed in 0.6.2

4 explicitly affected versions

0.4.1, 0.5.1, 0.6.0, 0.6.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "0.6.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.4.1",
    "0.5.1",
    "0.6.0",
    "0.6.1"
  ]
}

silverstripe/forum Packagist

Ecosystem versions

From 0.7.0 before 0.7.4

Fixed in 0.7.4

4 explicitly affected versions

0.7.0, 0.7.1, 0.7.2, 0.7.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.7.0"
        },
        {
          "fixed": "0.7.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.7.0",
    "0.7.1",
    "0.7.2",
    "0.7.3"
  ]
}

Set up in your agent.

Investigate in your agent.

Silverstripe Forum Module CSRF Vulnerability

The advisory, in context

Affected packages

References