PT-2022-16890 · Discourse · Discourse

Nattsw · Published 2022-04-11 · Updated 2024-03-06 · CVE-2022-24804

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.3 Discourse beta versions prior to 2.9.0.beta4

Description The issue concerns the erroneous exposure of groups in Discourse, an open source platform for community discussion. When a group with restricted visibility is used to set the permissions of a category, the name of the group is leaked to any user who can see the category.

Recommendations For versions prior to 2.8.3, a site administrator can remove groups with restricted visibility from any category's permissions setting as a workaround. For beta versions prior to 2.9.0.beta4, a site administrator can remove groups with restricted visibility from any category's permissions setting as a workaround.

Exploit

Fix

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-276

CWE-200

Related Identifiers

BIT-DISCOURSE-2022-24804

CVE-2022-24804

GHSA-V4C9-6M9G-37FF

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24804.json · Exploit
• https://github.com/discourse/discourse/commit/0f7b9878ff3207ce20970f0517604793920bb3d2 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2022-24804 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24804 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-v4c9-6m9g-37ff · Note
• https://t.me/cibsecurity/40576 · Telegram Post