PT-2022-16875 · Discourse · Discourse

Lowjomaxropublished · Published 2022-03-24 · Updated 2024-03-06 · CVE-2022-24782

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions 2.8.2 and prior in the stable branch Discourse versions 2.9.0.beta3 and prior in the beta branch Discourse versions 2.9.0.beta3 and prior in the tests-passed branch

Description Discourse is an open source discussion platform. Users can request an export of their own activity, which may sometimes include the name of a secure category due to category settings, potentially leading to a data leak. This can occur when a user has category membership for a secure category or when their post has been moved to a secure category.

Recommendations For versions 2.8.2 and prior in the stable branch, update to a version that includes the patch available in the main branch of Discourse's GitHub repository. For versions 2.9.0.beta3 and prior in the beta branch, update to a version that includes the patch available in the main branch of Discourse's GitHub repository. For versions 2.9.0.beta3 and prior in the tests-passed branch, update to a version that includes the patch available in the main branch of Discourse's GitHub repository.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2022-24782

CVE-2022-24782

GHSA-C3CQ-W899-F343

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24782.json · Exploit
• https://github.com/discourse/discourse/pull/16273 · Patch
• https://github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24782 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2022-24782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24782 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343 · Note
• https://t.me/cibsecurity/39513 · Telegram Post
• https://t.me/cvenotify/28573 · Telegram Post