Read the docs
TI-2024-38727 Aliases GHSA-w8fq-xgvh-cxc2

Silverstripe Forum Module CSRF Vulnerability

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-352 and CWE-425.

Summary

A number of form actions in the Forum module are directly accessible. A malicious user (e.g. spammer) can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures. Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting in a topic being moved. Thanks to Michael Strong for discovering.

Why it matters now

Fix Fixed silverstripe/forum (Packagist): 0.6.2, 0.7.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—silverstripe/forum (Packagist)before 0.6.20.6.2Patch availableGHSA-w8fq-xgvh-cxc2
—silverstripe/forum (Packagist)0.7.0 to before 0.7.40.7.4Patch availableGHSA-w8fq-xgvh-cxc2
  • silverstripe/forum (Packagist) Vendor— Affected before 0.6.2 Fixed in 0.6.2 Patch available GHSA-w8fq-xgvh-cxc2
  • silverstripe/forum (Packagist) Vendor— Affected 0.7.0 to before 0.7.4 Fixed in 0.7.4 Patch available GHSA-w8fq-xgvh-cxc2

Remediation

  • Fix · GHSA-w8fq-xgvh-cxc2 silverstripe/forum (Packagist) Fixed in 0.6.2 Advisory →
  • Fix · GHSA-w8fq-xgvh-cxc2 silverstripe/forum (Packagist) Fixed in 0.7.4 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-w8fq-xgvh-cxc2

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences