VWE-2019-5280 Printable Version

https://www.vaultwiki.org/pages/Book/Documentation/VWE-2019-5280
This page is a chapter in Info Known Vulnerabilities

This page has been seen 308,157 times.

- Created by
  pegasus
  on October 12, 2019
  
  Last updated by
  pegasus
  on December 5, 2024

Common Name None
VWE-ID VWE-2019-5280
Related Report None
Severity HIGH
Exploit Difficulty EASY
Platform XenForo 2.1.x
Description Subscription Management. Users may receive push notifications about wiki content, even though they have opted out of those notifications, as long as they are opted in to the corresponding alerts.

Discovered June 25, 2019
Resolved July 14, 2019
Patches Available 4.1.0 Beta 2
Workaround In AdminCP > Setup > VaultWiki: Notifications, uncheck Enable Wiki Subscriptions.
The versions listed below are known to be affected by this issue. If you are using one of those versions, you should update to a newer release that has no known vulnerabilities.

Common Name	None
VWE-ID	VWE-2019-5280
Related Report	None
Severity	HIGH
Exploit Difficulty	EASY
Platform	XenForo 2.1.x
Description	Subscription Management. Users may receive push notifications about wiki content, even though they have opted out of those notifications, as long as they are opted in to the corresponding alerts.
Discovered	June 25, 2019
Resolved	July 14, 2019
Patches Available	4.1.0 Beta 2
Workaround	In AdminCP > Setup > VaultWiki: Notifications, uncheck Enable Wiki Subscriptions.