PT-2019-14237 · Discourse · Discourse

Publicado 2019-08-26 · Atualizado 2019-08-29 · CVE-2019-15515

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse version 2.3.2

Description The issue involves Discourse sending the CSRF token in the query string, which could potentially be exploited.

Recommendations For Discourse version 2.3.2, consider updating to a newer version that does not send the CSRF token in the query string, or as a temporary workaround, restrict access to sensitive operations that rely on the CSRF token.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-15515

Produtos afetados

Discourse

Referências · 3

• https://github.com/discourse/discourse/pull/8026 · Correção
• https://osv.dev/vulnerability/CVE-2019-15515 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15515 · Nota de Segurança