{"id":"CVE-2023-1883","aliases":["EUVD-2023-1164","GHSA-2wjp-w7g7-h63q"],"status":"published","title":"Improper Access Control in thorsten/phpmyfaq","description":"Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00492,"percentile":0.4259,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2023-04-05T00:00:00Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Packagist","package":"thorsten/phpmyfaq","fixed_in":["3.1.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"thorsten/phpmyfaq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"thorsten/phpmyfaq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12"}]}],"versions":["2.10.0-alpha","2.8.0","2.8.0-RC","2.8.0-RC2","2.8.0-RC3","2.8.0-RC4","2.8.0-alpha2","2.8.0-alpha3","2.8.0-beta","2.8.0-beta2","2.8.0-beta3","2.8.1","2.8.10","2.8.11","2.8.12","2.8.13","2.8.14","2.8.15","2.8.16","2.8.17","2.8.18","2.8.19","2.8.2","2.8.20","2.8.21","2.8.22","2.8.23","2.8.24","2.8.25","2.8.26","2.8.27","2.8.28","2.8.29","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0-alpha","2.9.0-alpha2","2.9.0-alpha3","2.9.0-alpha4","2.9.0-beta","2.9.0-beta2","2.9.0-rc","2.9.0-rc2","2.9.0-rc3","2.9.0-rc4","2.9.1","2.9.10","2.9.11","2.9.12","2.9.13","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.0-RC","3.0.0-RC.2","3.0.0-alpha","3.0.0-alpha.2","3.0.0-alpha.3","3.0.0-alpha.4","3.0.0-beta","3.0.0-beta.2","3.0.0-beta.3","3.0.1","3.0.10","3.0.11","3.0.12","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.0-RC","3.1.0-alpha","3.1.0-alpha.2","3.1.0-alpha.3","3.1.0-beta","3.1.1","3.1.10","3.1.11","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]}],"products":[{"vendor":"phpmyfaq","product":"phpmyfaq"},{"vendor":"thorsten","product":"thorsten/phpmyfaq"}],"references":[{"url":"https://huntr.dev/bounties/2f1e417d-cf64-4cfb-954b-3a9cb2f38191","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/thorsten/phpmyfaq/commit/db77df888178766987398597d4f153831c62a503","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1883","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2wjp-w7g7-h63q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1883.json","tags":["advisory"]},{"url":"https://github.com/thorsten/phpMyFAQ","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-1883","title":"Improper Access Control in thorsten/phpmyfaq","description":"Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.","status":"published","published":"2023-04-05T00:00:00Z","modified":"2025-02-10T19:49:15.168Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-1164","description":"Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.","status":"published","published":"2023-04-05T00:00:00Z","modified":"2025-02-10T19:49:15Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:00.770319Z"}],"ghsa":[{"id":"GHSA-2wjp-w7g7-h63q","title":"thorsten/phpmyfaq vulnerable to improper access control","description":"thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.","status":"published","published":"2023-04-05T18:30:18Z","modified":"2023-04-06T15:07:52Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"nvd":[{"id":"CVE-2023-1883","description":"Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.","status":"published","published":"2023-04-05T17:15:07.273Z","modified":"2026-06-17T05:28:57.53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:53.719171Z"}],"osv":[{"id":"CVE-2023-1883","title":"Improper Access Control in thorsten/phpmyfaq","description":"Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.","status":"published","published":"2023-04-05T00:00:00Z","modified":"2026-10-28T02:30:50.044587875Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"GHSA-2wjp-w7g7-h63q","title":"thorsten/phpmyfaq vulnerable to improper access control","description":"thorsten/phpmyfaq prior to 3.1.12 is vulnerable to improper access control when FAQ News is marked as inactive in settings and have comments enabled, allowing comments to be posted on inactive FAQs. This has been fixed in 3.1.12.","status":"published","published":"2023-04-05T18:30:18Z","modified":"2023-11-08T04:11:20.969079Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}