LiveActive security incident?Get immediate response
CVE Record

CVE-2019-13183: Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-13183 is a cross-site request forgery issue in Flarum before 0.1.0-beta.9. A victim with an active session could be tricked into making unwanted POST requests, including changing administrator settings. The sources do not provide CVSS scoring or evidence of active exploitation.

Executive priority

Treat this as a legacy-platform remediation item, not an emergency based on current evidence. Prioritize any exposed Flarum forum below 0.1.0-beta.9 because administrator actions could be forged, but the supplied sources do not show active exploitation.

Technical view

Flarum versions before 0.1.0-beta.9 allowed CSRF against all POST endpoints. The public description specifically demonstrates the risk through unauthorized admin setting changes. The bundle does not include detailed affected CPEs, proof-of-concept specifics, exploit telemetry, or complete remediation notes beyond the fixed release boundary.

Likely exposure

Exposure is most likely limited to legacy Flarum deployments running before 0.1.0-beta.9, especially public forums where administrators stay logged in while browsing external content. The supplied affected-product metadata is incomplete, so asset confirmation must rely on Flarum version inventory.

Exploitation context

No provided source states active exploitation, and the CVE is not listed as KEV. Practical impact depends on a logged-in user being induced to submit unintended requests. Administrative sessions are the highest concern because the CVE description cites admin setting changes.

Researcher notes

The evidence base is sparse: no CVSS vector, CWE mapping, CPE data, or exploit status is included. Analysis should stay anchored to the known boundary: Flarum before 0.1.0-beta.9 and CSRF across POST endpoints, demonstrated by admin setting changes.

Mitigation direction

  • Upgrade Flarum to 0.1.0-beta.9 or a later supported release.
  • Review the Flarum GHSA advisory, changelog, and release notes for vendor guidance.
  • Prioritize remediation for internet-facing forums with active administrator accounts.
  • Reduce administrator browsing risk until upgraded by avoiding untrusted links while logged in.

Validation and detection

  • Inventory all Flarum deployments and record their exact versions.
  • Confirm every deployment is running 0.1.0-beta.9 or later.
  • Review admin settings for unexpected changes on previously vulnerable instances.
  • Check logs around sensitive POST actions where available.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-13183 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.