PT-2022-16940 · Discourse · Discourse Assign

Pmusaraj · Published 2022-04-26 · Updated 2022-05-06 · CVE-2022-24866

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse Assign versions prior to 1.0.1

Description The UserBookmarkSerializer in Discourse Assign serialized the whole User / Group object, which leaked some private information. This data was only accessible to people who could view assignment info, limited to staff by default, but for sites with assign features enabled publicly, the data was accessible to more people than just staff.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 to resolve the issue. As a temporary workaround, consider restricting access to assignment info to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-24866

GHSA-9XHF-WVJX-F5W9

Affected Products

Discourse Assign

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24866.json · Exploit
• https://github.com/discourse/discourse-assign/pull/320 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24866 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24866 · Vendor Advisory
• https://github.com/discourse/discourse-assign/security/advisories/GHSA-9xhf-wvjx-f5w9 · Note
• https://t.me/cibsecurity/41454 · Telegram Post
• https://t.me/cvenotify/29792 · Telegram Post