PT-2022-26144 · Discourse · Discourse Calendar

Jomaxro + 1 · Published 2022-11-14 · Updated 2022-11-17 · CVE-2022-41913

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse-calendar (affected versions not specified)

Description The Discourse-calendar plugin for the Discourse messaging platform is affected by an issue that allows users to list members of private groups or public groups with private members, and create and edit post events. This issue only affects sites with discourse post events enabled. The issue has been patched in a commit, which will be included in future releases.

Recommendations To fully mitigate the issue, users unable to upgrade should disable the discourse post event enabled setting. As a temporary workaround, it's possible to prevent regular users from using this vulnerability by removing all groups from the discourse post event allowed on groups, but note that moderators will still be able to use it.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-41913

GHSA-JH96-W279-G7R9

Affected Products

Discourse Calendar

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41913.json · Exploit
• https://github.com/discourse/discourse-calendar/commit/ca5ae3e7e0c2b32af5ca4ec69c95e95b2ecef2e9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41913 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41913 · Vendor Advisory
• https://github.com/discourse/discourse-calendar/security/advisories/GHSA-jh96-w279-g7r9 · Note
• https://t.me/cibsecurity/52974 · Telegram Post
• https://t.me/cvenotify/37986 · Telegram Post