CVE-2022-35921

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-269CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-359227.5Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an ouCVE-2022-359237.5v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in thCVE-2022-359249.1NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` CVE-2022-359259.8BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which alCVE-2022-359267.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discoveryCVE-2022-359279.8Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the ConCVE-2022-359285.5AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version CVE-2022-359299.8cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exCVE-2022-359308.8PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will rCVE-2022-359312.7Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, CVE-2022-359325.3Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversCVE-2022-359336.1This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could s
CVE-2022-35921: Medium severity, CVSS 4.3 | Vulnix