PT-2022-23155 · Discourse · Discourse

Highjomax · Published 2022-09-29 · Updated 2024-03-06 · CVE-2022-36068

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2.8.9 Discourse versions prior to 2.9.0.beta10

Description The issue allows a moderator to create new and edit existing themes using the API when they should not have this capability.

Recommendations For versions prior to 2.8.9, update to version 2.8.9 or later. For versions prior to 2.9.0.beta10, update to version 2.9.0.beta10 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2022-36068

CVE-2022-36068

GHSA-6CRR-3662-263Q

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36068.json · Exploit
• https://github.com/discourse/discourse/pull/18418 · Patch
• https://github.com/discourse/discourse/commit/ae1e536e83940d58f1c79b835c75c249121c46b6 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2022-36068 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36068 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36068 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-6crr-3662-263q · Note
• https://t.me/cibsecurity/50747 · Telegram Post