PT-2022-24828 · Discourse · Discourse

Lowjomaxro · Published 2022-09-29 · Updated 2024-03-06 · CVE-2022-39232

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Discourse versions 2.9.0.beta5 through 2.9.0.beta9

Description The issue arises when an incomplete quote generates a JavaScript error, potentially crashing the current page in the browser. This occurs in certain cases and is related to how the platform handles quotes. The problem is resolved in version 2.9.0.beta10, which includes a fix and additional tests to prevent incomplete quotes from causing issues.

Recommendations For versions 2.9.0.beta5 through 2.9.0.beta9, update to version 2.9.0.beta10 to resolve the issue. As a temporary workaround for affected versions, the quote can be fixed via the rails console.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-DISCOURSE-2022-39232

CVE-2022-39232

GHSA-CV64-V73F-7WQ5

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39232.json · Exploit
• https://github.com/discourse/discourse/pull/18311 · Patch
• https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2022-39232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39232 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39232 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5 · Note
• https://t.me/cvenotify/54122 · Telegram Post