PT-2022-20594 · Discourse · Discourse

Jomaxro · Published 2022-08-01 · Updated 2024-03-06 · CVE-2022-31184

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse (affected versions not specified)

Description Discourse is an open source discussion platform. In affected versions, an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta, and tests-passed versions of Discourse, which rate limits emails.

Recommendations For all affected versions, users are advised to upgrade to the latest stable, beta, or tests-passed version. Users unable to upgrade should manually rate limit email.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-DISCOURSE-2022-31184

CVE-2022-31184

GHSA-M5W9-8GP8-2HRF

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31184.json · Exploit
• https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31184 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2022-31184 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31184 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrf · Note
• https://t.me/cvenotify/34118 · Telegram Post
• https://t.me/cibsecurity/47376 · Telegram Post