PT-2022-24939 · Discourse · Discourse

Jomaxro · Published 2022-11-02 · Updated 2024-03-06 · CVE-2022-39378

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta and tests-passed versions

Description The issue affects Discourse, a platform for community discussion. Under certain conditions, a user badge may be awarded based on a user's activity in a topic with restricted access. Before this issue was disclosed, the topic title of the topic associated with the user badge could be viewed by any user, potentially exposing sensitive information in the topic title.

Recommendations For versions prior to the latest stable, beta and tests-passed versions, update to the latest stable, beta or tests-passed version of Discourse to resolve the issue. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2022-39378

CVE-2022-39378

GHSA-2GVQ-27H6-4H5F

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39378.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39378 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2022-39378 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39378 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-2gvq-27h6-4h5f · Note
• https://t.me/cibsecurity/52487 · Telegram Post