CVE-2019-11514

moderate-risk

Published 2019-04-25

User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.

Do I need to act?

0.24% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Flarum

Flarum

Third Party Advisory https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released

Patch https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7

Third Party Advisory https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released

Patch https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate