PT-2022-20523 · Discourse · Discourse-Chat

Zogstrip · Published 2022-06-21 · Updated 2023-07-24 · CVE-2022-31095

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions discourse-chat versions prior to 0.4

Description The issue affects the discourse-chat plugin for the Discourse application, allowing an attacker who knows the message ID for a channel they do not have access to, to view that message using the chat message lookup endpoint. This primarily affects direct message channels. There are no known workarounds for this issue.

Recommendations For versions prior to 0.4, update the plugin to a version 0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the chat message lookup endpoint until the plugin can be updated.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2022-31095

GHSA-R979-JHP2-3F6H

Affected Products

Discourse-Chat

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31095.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31095 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31095 · Vendor Advisory
• https://github.com/discourse/discourse-chat/security/advisories/GHSA-r979-jhp2-3f6h · Note
• https://t.me/cvenotify/31964 · Telegram Post
• https://t.me/cibsecurity/44919 · Telegram Post