PT-2021-21813 · Discourse · Discourse

Tgxworld · Published 2021-08-13 · Updated 2024-03-06 · CVE-2021-37693

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.7.8 Discourse versions prior to 2.8.0.beta4

Description The issue concerns the email verification process in Discourse. When adding an extra email address to an existing account, an email token is generated. If the additional email address is deleted, the unused token remains valid and can be used in other contexts, such as resetting a password.

Recommendations For versions prior to 2.7.8, update to version 2.7.8 or later to resolve the issue. For versions prior to 2.8.0.beta4, update to version 2.8.0.beta4 or later to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-640

Related Identifiers

BIT-DISCOURSE-2021-37693

CVE-2021-37693

GHSA-9377-96F4-CWW4

Affected Products

Discourse

References · 5

• https://github.com/discourse/discourse/commit/fb14e50741a4880cda22244eded8858e2f5336ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37693 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37693 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2021-37693 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-9377-96f4-cww4 · Note