PT-2022-24944 · Discourse · Discourse

Highjomaxro · Published 2022-11-14 · Updated 2024-03-06 · CVE-2022-39385

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse (affected versions not specified)

Description The issue affects the Discourse open source discussion platform, where in rare cases, users redeeming an invitation can be added as a participant to several private message topics they should not have access to, without being notified. This happens transparently in the background.

Recommendations To resolve the issue, users are advised to upgrade to a future release that includes the fix. As a temporary workaround, consider setting SiteSetting.max invites per day to 0 until the patch is installed.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

BIT-DISCOURSE-2022-39385

CVE-2022-39385

GHSA-GH5R-J595-QX48

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39385.json · Exploit
• https://github.com/discourse/discourse/commit/a414520742da8dc9dc976d4fb7b72dbd445813bb · Patch
• https://osv.dev/vulnerability/CVE-2022-39385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39385 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2022-39385 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-gh5r-j595-qx48 · Note
• https://t.me/cvenotify/37990 · Telegram Post
• https://t.me/cvenotify/37682 · Telegram Post