phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, …
Medium CVSS 5.3
Summary
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq
- https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resources
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq
Timeline
- nvd_ingest NVD