Today, we have released security maintenance updates for all supported XenForo releases from XenForo 2.2.0 through XenForo 2.3.12, together with applicable XenForo Media Gallery updates. These fixes are all thanks to the efforts of Marco Paciaroni (BomboBombone) who kindly submitted 14 findings to us via VulnCheck.
These releases resolve 14 security vulnerabilities affecting several areas of XenForo. Depending on the XenForo version, enabled features, configuration, and privileges available to an attacker, the issues may permit unauthorised actions, disclosure of protected information, cross-site scripting, server-side requests, token replay, denial of service, or, in one specific administrative workflow, arbitrary code execution.
Rather than releasing a new main version for customers with active licenses, and manual patches for everyone else to apply manually, we have made the decision to essentially re-release every single XenForo version since version 2.2.0 with an appropriate patch release. For example, if you are currently running version 2.2.9, you are free to upgrade to version 2.2.9 Patch 1 without renewing your license.
We strongly recommend that all customers running XenForo 2.2.x or 2.3.x upgrade to the patch release corresponding to their currently installed version as soon as possible. Where available, we recommend using one-click upgrades to apply the upgrade for you.
XenForo Cloud customers have received the relevant patches already as part of a modified XenForo 2.3.11 build.
If you are able to, we strongly recommend upgrading to XenForo 2.3.13 which, as well as the security issues here, also adds the usual swathe of fixes and improvements. See the separate 2.3.13 release announcement for details of those changes.
If you are a XenForo Cloud customer, your installations have already been patched and no further action is required. You will remain on version 2.3.11. 2.3.13 is also being released with other bug fixes and improvements.
As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area.
Full details of how to install and upgrade XenForo can be found in the XenForo manual. We strongly recommend upgrading directly from within your control panel.
These releases resolve 14 security vulnerabilities affecting several areas of XenForo. Depending on the XenForo version, enabled features, configuration, and privileges available to an attacker, the issues may permit unauthorised actions, disclosure of protected information, cross-site scripting, server-side requests, token replay, denial of service, or, in one specific administrative workflow, arbitrary code execution.
Rather than releasing a new main version for customers with active licenses, and manual patches for everyone else to apply manually, we have made the decision to essentially re-release every single XenForo version since version 2.2.0 with an appropriate patch release. For example, if you are currently running version 2.2.9, you are free to upgrade to version 2.2.9 Patch 1 without renewing your license.
We strongly recommend that all customers running XenForo 2.2.x or 2.3.x upgrade to the patch release corresponding to their currently installed version as soon as possible. Where available, we recommend using one-click upgrades to apply the upgrade for you.
XenForo Cloud customers have received the relevant patches already as part of a modified XenForo 2.3.11 build.
If you are able to, we strongly recommend upgrading to XenForo 2.3.13 which, as well as the security issues here, also adds the usual swathe of fixes and improvements. See the separate 2.3.13 release announcement for details of those changes.
One-click upgrade
Directly from your admin control panelIf you are a XenForo Cloud customer, your installations have already been patched and no further action is required. You will remain on version 2.3.11. 2.3.13 is also being released with other bug fixes and improvements.
As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area.
Full details of how to install and upgrade XenForo can be found in the XenForo manual. We strongly recommend upgrading directly from within your control panel.