PT-2022-16903 · Discourse · Discourse

Pmusaraj · Published 2022-04-14 · Updated 2024-03-06 · CVE-2022-24824

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed versions

Description The issue affects Discourse, an open source platform for community discussion. An attacker can poison the cache for anonymous users, causing them to see the crawler view of the site instead of the HTML page, leading to a partial denial-of-service.

Recommendations Update to the latest stable, beta, or tests-passed version of Discourse to resolve the issue. As a temporary workaround, consider restricting access to anonymous users or implementing additional caching controls until a patch is applied.

Exploit

Fix

DoS

Weakness Enumeration

CWE-829

Related Identifiers

BIT-DISCOURSE-2022-24824

CVE-2022-24824

GHSA-46V9-3JC4-F53W

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24824.json · Exploit
• https://github.com/discourse/discourse/commit/b72b0dac10493d09f4f9eb8f3c3ce7817295e34e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24824 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24824 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2022-24824 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-46v9-3jc4-f53w · Note
• https://t.me/cibsecurity/40841 · Telegram Post