Cross site scripting vulnerability with discussion titles
Date: 2022-11
Affected: composer/flarum/core
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-41938
CWE: CWE-79
CVSS: 9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)

Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page. ### Impact All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted. ### Patches The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2 using: ``` composer update --prefer-dist --no-dev -a -W ``` You can then confirm you run the latest version using: ``` composer show flarum/core ``` ### Workarounds **None** ### For more information For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558. For support questions create a discussion at https://discuss.flarum.org/t/support. A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.


Mitigations:

Architectural layers (MAESTRO):