https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 08 Jun 2026 18:57:57 +0000 https://vulnerability.circl.lu/sighting/a4e658f7-6192-4393-8ed2-567792186633/export {"uuid": "a4e658f7-6192-4393-8ed2-567792186633", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40033", "type": "seen", "source": "https://t.me/cibsecurity/68695", "content": "\u203c CVE-2023-40033 \u203c\n\nFlarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-17T00:36:48.000000Z"} {"uuid": "a4e658f7-6192-4393-8ed2-567792186633", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40033", "type": "seen", "source": "https://t.me/cibsecurity/68695", "content": "\u203c CVE-2023-40033 \u203c\n\nFlarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-17T00:36:48.000000Z"} https://vulnerability.circl.lu/sighting/a4e658f7-6192-4393-8ed2-567792186633/export Thu, 17 Aug 2023 00:36:48 +0000 https://vulnerability.circl.lu/sighting/d1947240-36d4-4574-84c2-4b4679aa7e85/export {"uuid": "d1947240-36d4-4574-84c2-4b4679aa7e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40033", "type": "seen", "source": "https://t.me/arpsyndicate/344", "content": "#ExploitObserverAlert\n\nCVE-2023-40033\n\nDESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-40033. Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.\n\nFIRST-EPSS: 0.000490000\nNVD-IS: 4.2\nNVD-ES: 2.8", "creation_timestamp": "2023-11-22T10:47:08.000000Z"} {"uuid": "d1947240-36d4-4574-84c2-4b4679aa7e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-40033", "type": "seen", "source": "https://t.me/arpsyndicate/344", "content": "#ExploitObserverAlert\n\nCVE-2023-40033\n\nDESCRIPTION: Exploit Observer has 1 entries related to CVE-2023-40033. Flarum is an open source forum software. Flarum is affected by a vulnerability that allows an attacker to conduct a Blind Server-Side Request Forgery (SSRF) attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack. This has been patched in Flarum version 1.8.0. Users are advised to upgrade. Users unable to upgrade may disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs as a temporary workaround for the SSRF aspect of the vulnerability.\n\nFIRST-EPSS: 0.000490000\nNVD-IS: 4.2\nNVD-ES: 2.8", "creation_timestamp": "2023-11-22T10:47:08.000000Z"} https://vulnerability.circl.lu/sighting/d1947240-36d4-4574-84c2-4b4679aa7e85/export Wed, 22 Nov 2023 10:47:08 +0000