CVE-2021-43847
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| humhub | humhub | >= 1.10.0, < 1.10.3 | affected |
| humhub | humhub | < 1.9.3 | affected |
Weaknesses
- CWE-285: CWE-285: Improper Authorization
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74
- https://github.com/humhub/humhub/pull/5473
- https://github.com/humhub/humhub/releases/tag/v1.10.3
- https://github.com/humhub/humhub/releases/tag/v1.9.3
- https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/
References
- https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74
- https://github.com/humhub/humhub/pull/5473
- https://github.com/humhub/humhub/releases/tag/v1.10.3
- https://github.com/humhub/humhub/releases/tag/v1.9.3
- https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.