PT-2021-21822 · Discourse · Discourse

Tgxworld · Published 2021-08-13 · Updated 2024-03-06 · CVE-2021-37703

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.7.8 Discourse versions prior to 2.8.0.beta5

Description The issue exposes a user's read state for a topic, including the last read post number and the notification level.

Recommendations For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 2.8.0.beta5, update to version 2.8.0.beta5 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2021-37703

CVE-2021-37703

GHSA-GQ2H-QHG2-PHF9

Affected Products

Discourse

References · 5

• https://github.com/discourse/discourse/commit/aed65ec16d38886d7be7209d8c02df4ffd4937a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37703 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2021-37703 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37703 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-gq2h-qhg2-phf9 · Note