Detections
Analytics
SCA: security update for flarum/mentions (GHSA-22m9-m3ww-53h3)
medium Tenable Cloud Security Plugin ID 408608
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Flarum is a forum software for building communities. Using the mentions feature provided by the
flarum/mentions extension, users can mention any post ID on the forum with the special
`@"<username>"#p<id>` syntax. The following behavior never changes no matter if the actor should be able
to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML,
leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST
/api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned
posts without any access control. This includes the content, date, number and attributes added by other
extensions. An attacker only needs the ability to create new posts on the forum to exploit the
vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the
attack can be performed even more discreetly by using a single post to scan any size of database and
hiding the attack post content afterward. The attack allows the leaking of all posts in the forum
database, including posts awaiting approval, posts in tags the user has no access to, and private
discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts
like tag changes or renaming events. The discussion payload is not leaked but using the mention HTML
payload it's possible to extract the discussion ID of all posts and combine all posts back together into
their original discussions even if the discussion title remains unknown. All Flarum versions prior to
1.6.3 are affected. The vulnerability has been fixed and published as flarum/core v1.6.3. As a workaround,
user can disable the mentions extension. (CVE-2023-22487)
See Also
Plugin Details
Severity: Medium
ID: 408608
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2023-22487
CVSS v3
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/10/2023
Vulnerability Publication Date: 1/10/2023
Reference Information
CVE: CVE-2023-22487
cwe: CWE-284