Vulnerability · Published Apr 20, 2022 · Assigned by GitHub_M

CVE-2022-24865Improper access control in humhub

Medium 6.5

In plain English

A medium-severity information exposure in humhub from humhub. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.2%top 30.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
humhub	humhub	>= 1.10.0, < 1.10.4< 1.9.4

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/humhub/humhub/security/advisories/GHSA-2h35-f226-3f57 x_refsource_CONFIRM
https://github.com/humhub/humhub/commit/eb83de20aaecc559ab77a44a6179646a99607e33 x_refsource_MISC
https://huntr.dev/bounties/89d996a2-de30-4261-8e3f-98e54cb25f76/ x_refsource_MISC