Flagforge
Monthly
Flagforge versions 2.3.2 and earlier suffer from a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint that accepts unvalidated usernames containing regex metacharacters, allowing unauthenticated remote attackers to trigger excessive CPU consumption and deny service to legitimate users. The MongoDB regex engine processes these malicious patterns inefficiently, making the platform unavailable without administrator intervention. No patch is currently available; users should implement WAF rules to filter regex metacharacters from username inputs as a temporary mitigation.
Data exposure and unauthorized badge-template creation in FlagForge versions 2.0.0 through 2.3.1 allow remote unauthenticated attackers to retrieve all badge templates with createdBy/createdAt/updatedAt metadata and to insert arbitrary badge templates through the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints. The flaw is CWE-200 and is fixed in FlagForge v2.3.2; no public exploit identified at time of analysis, and EPSS is 0.45% (37th percentile). Despite the supplied 9.1 CVSS, the independent assessment bounds impact to the badge-template subsystem with low confidentiality and integrity impact, making real-world priority moderate.
Unauthenticated remote attackers can create, modify, or delete resources on Flag Forge CTF platform instances running versions 2.0.0 through any release before 2.3.1, because the /api/resources endpoint performed no authentication or authorization checks on POST and DELETE requests. The flaw is a broken access control issue (CWE-284, CVSS 8.2) requiring only network reachability to the endpoint on an affected, default deployment - no credentials, no user interaction, and no special configuration per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is limited to integrity and availability (resources can be tampered with or deleted, with no confidentiality impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is low at 0.06% (17th percentile). The vendor has fixed the issue in Flag Forge 2.3.1.
Flag Forge is a Capture The Flag (CTF) platform. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Flagforge versions 2.3.2 and earlier suffer from a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint that accepts unvalidated usernames containing regex metacharacters, allowing unauthenticated remote attackers to trigger excessive CPU consumption and deny service to legitimate users. The MongoDB regex engine processes these malicious patterns inefficiently, making the platform unavailable without administrator intervention. No patch is currently available; users should implement WAF rules to filter regex metacharacters from username inputs as a temporary mitigation.
Data exposure and unauthorized badge-template creation in FlagForge versions 2.0.0 through 2.3.1 allow remote unauthenticated attackers to retrieve all badge templates with createdBy/createdAt/updatedAt metadata and to insert arbitrary badge templates through the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints. The flaw is CWE-200 and is fixed in FlagForge v2.3.2; no public exploit identified at time of analysis, and EPSS is 0.45% (37th percentile). Despite the supplied 9.1 CVSS, the independent assessment bounds impact to the badge-template subsystem with low confidentiality and integrity impact, making real-world priority moderate.
Unauthenticated remote attackers can create, modify, or delete resources on Flag Forge CTF platform instances running versions 2.0.0 through any release before 2.3.1, because the /api/resources endpoint performed no authentication or authorization checks on POST and DELETE requests. The flaw is a broken access control issue (CWE-284, CVSS 8.2) requiring only network reachability to the endpoint on an affected, default deployment - no credentials, no user interaction, and no special configuration per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Impact is limited to integrity and availability (resources can be tampered with or deleted, with no confidentiality impact), and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is low at 0.06% (17th percentile). The vendor has fixed the issue in Flag Forge 2.3.1.
Flag Forge is a Capture The Flag (CTF) platform. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Flag Forge is a Capture The Flag (CTF) platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Flag Forge is a Capture The Flag (CTF) platform. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.