PT-2021-19931 · Discourse · Discourse

Zogstrip · Published 2021-07-27 · Updated 2024-03-06 · CVE-2021-32788

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.7.7

Description Discourse is an open source discussion platform. There are two bugs that led to the post creator of a whisper post being revealed to non-staff users. The first bug occurs when a staff user creates a whisper post in a personal message, revealing the staff user to non-staff participants of the personal message, even though the whisper post cannot be seen by them. The second bug happens when a whisper post is before the last post in a post stream, and deleting the last post results in the creator of the whisper post being revealed to non-staff users as the last poster of the topic.

Recommendations For versions prior to 2.7.7, update to version 2.7.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of whisper posts in personal messages and avoiding deletion of the last post in a post stream to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BIT-DISCOURSE-2021-32788

CVE-2021-32788

GHSA-V6XG-Q577-VC92

Affected Products

Discourse

References · 9

• https://github.com/discourse/discourse/commit/dbdf61196d9e964e8823793d2e7f856595fea4d9 · Patch
• https://github.com/discourse/discourse/commit/680024f9071b7696e5a444a58791016c6dc1f1e5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32788 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2021-32788 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32788 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-v6xg-q577-vc92 · Note
• https://t.me/cibsecurity/26550 · Telegram Post
• https://t.me/cvenotify/18212 · Telegram Post
• https://t.me/cvenotify/18680 · Telegram Post