Multiple Vulnerabilities Found In XenForo

[joelr]

According to a recent security update shared on XenForo forums, the service addressed numerous security vulnerabilities with the latest XenForo release.

As stated, the vulnerabilities included a cross-site request forgery (CSRF) and code injection flaw that could lead to remote code execution and cross-site scripting (XSS) attacks.

XenForo credited the security researcher Egidio Romano for reporting most of these flaws via SSD Secure Disclosure. While the firm didn’t share details about the vulnerabilities in its post, SSD Secure Disclosure shared a detailed analysis in a separate advisory. These vulnerabilities include CVE-2024-38457 – a CSRF vulnerability, and CVE-2024-38458 – a remote code execution flaw.

https://xenforo.com/community/threa...-2-6-released-includes-security-fixes.222133/

 

[Tracy]

They released a patch for 2.1.15 and also for 2.1.16. You could either apply the patch manually or use the upgrade feature in the ACP if your license was active for updates/support. That was why they also released a patch that could be uploaded to the site, for those that did not have active support for the "latest & greatest" downloads.

https://xenforo.com/community/threa...-2-6-released-includes-security-fixes.222133/

 

[joelr]

I think it's great that XF released a patch for those that don't have active support.