PT-2022-15035 · Discourse · Discourse

Nathan Kershaw + 1 · Published 2022-01-13 · Updated 2024-03-06 · CVE-2022-21684

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.7.13 Discourse version 2.8.0.beta11 in beta and tests-passed

Description The issue allows some users to log in to a community before they should be able to do so. A user invited via email to a forum with must approve users enabled can bypass the check that does not allow unapproved users to sign in. They will have the same capabilities as an approved user, but will not be able to log back in after logging out.

Recommendations For versions prior to 2.7.13, update to version 2.7.13 or later. For version 2.8.0.beta11 in beta and tests-passed, update to a later version. As a temporary workaround, consider disabling invites or increase min trust level to allow invite to reduce the attack surface to more trusted users.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-DISCOURSE-2022-21684

CVE-2022-21684

GHSA-P63Q-JP48-H8XH

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21684.json · Exploit
• https://github.com/discourse/discourse/commit/584c6a2e8bc705072b09a9c4b55126d6f8ed4ad2 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-p63q-jp48-h8xh · Patch
• https://osv.dev/vulnerability/BIT-discourse-2022-21684 · Vendor Advisory
• https://meta.discourse.org/t/invite-redemption-allowed-user-to-access-forum-before-approval/214328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21684 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21684 · Vendor Advisory