PT-2022-24924 · Discourse · Discourse

Onedaycoder · Published 2022-11-02 · Updated 2024-03-06 · CVE-2022-39356

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Discourse (affected versions not specified)

Description Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin user's email and gain access to their account when accepting the invitation.

Recommendations Upgrade to the latest version. As a temporary workaround, consider disabling invitations with SiteSetting.max invites per day = 0 or scope them to individual email addresses.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BIT-DISCOURSE-2022-39356

CVE-2022-39356

GHSA-X8W7-RWMR-W278

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39356.json · Exploit
• https://github.com/discourse/discourse/pull/18817 · Patch
• https://osv.dev/vulnerability/BIT-discourse-2022-39356 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39356 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-x8w7-rwmr-w278 · Note
• https://t.me/cvenotify/37039 · Telegram Post
• https://t.me/cibsecurity/52482 · Telegram Post
• https://t.me/cvenotify/53164 · Telegram Post