CVE-2022-35921

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

01/08/2022

Last modified:

21/07/2023

Description

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum&#39;s users and choose to disable the extension if needed. There are no workarounds for this issue.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS v3.1 Severity and Metrics:

Base Score: 4.30 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): None

Base Score 3.x

4.30

Severity 3.x

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:friendsofflarum:byobu::::::::	0.32.0 (including)	1.1.7 (excluding)
cpe:2.3:a:friendsofflarum:byobu:0.30.0:beta2::::::

To consult the complete list of CPE names with products and versions, see this page

CVE-2022-35921

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools