PT-2021-23938 · Discourse · Discourse

Samuel Grant + 1 · Published 2021-12-01 · Updated 2024-03-06 · CVE-2021-43792

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.11

Description: A vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature in Discourse, an open source discussion platform. This feature allows a tag group to restrict visibility of certain tags to specific groups, such as staff. However, if a user's group status is revoked, they may still receive notifications related to the tag, even though they can no longer view the tag on each topic.

Recommendations: For versions prior to 2.7.11, upgrade to version 2.7.11 or later as soon as possible to resolve the issue. As a temporary workaround, consider restricting access to the /preferences/tags endpoint for users who have had their staff status revoked, until the upgrade can be applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2021-43792

CVE-2021-43792

GHSA-PQ2X-VQ37-8522

Affected Products

Discourse

References · 7

• https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4 · Patch
• https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43792 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43792 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2021-43792 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522 · Note
• https://t.me/cibsecurity/33226 · Telegram Post