PT-2022-20524 · Discourse · Discourse

Highpmusaraj · Published 2022-06-27 · Updated 2024-03-06 · CVE-2022-31096

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse (affected versions not specified)

Description The issue allows a logged-in user to redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. This flaw can lead to a user being incorrectly added to restricted groups, potentially allowing them to view restricted content.

Recommendations To resolve the issue, users are advised to upgrade to the current stable releases. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

BIT-DISCOURSE-2022-31096

CVE-2022-31096

GHSA-RVP8-459H-282R

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31096.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31096 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2022-31096 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31096 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-rvp8-459h-282r · Note
• https://t.me/cvenotify/32271 · Telegram Post
• https://t.me/cibsecurity/45252 · Telegram Post