PT-2021-23123 · Discourse · Discourse-Reactions

Jomaxro · Published 2021-10-19 · Updated 2022-08-12 · CVE-2021-41140

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse-reactions versions prior to 0.2

Description The issue affects the Discourse-reactions plugin, allowing reactions to secure topics and private messages to be visible. This affects the confidentiality of user interactions within the platform.

Recommendations For versions prior to 0.2, update to version 0.2 to resolve the issue. As a temporary workaround for users unable to update, disable the Discourse-reactions plugin in the admin panel.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2021-41140

GHSA-9358-HWG5-JRMH

Affected Products

Discourse-Reactions

References · 5

• https://github.com/discourse/discourse-reactions/commit/213d90b82fd15c4186ebc290fee18817d9727d0d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41140 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41140 · Vendor Advisory
• https://github.com/discourse/discourse-reactions/security/advisories/GHSA-9358-hwg5-jrmh · Note
• https://t.me/cibsecurity/30820 · Telegram Post