Detections
Analytics

SCA: security update for flarum/core, flarum/framework (GHSA-67c6-q4j4-hccg)

high Tenable Cloud Security Plugin ID 411271

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to
 conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a
 basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type,
 an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the
 behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a
 URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF
 attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum
 version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen`
 which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect
 of the vulnerability. (CVE-2023-40033)

See Also

https://github.com/advisories/GHSA-67c6-q4j4-hccg

Plugin Details

Severity: High

ID: 411271

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.91

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:N

CVSS Score Source: CVE-2023-40033

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/16/2023

Vulnerability Publication Date: 8/16/2023

Reference Information

CVE: CVE-2023-40033