PT-2025-3200 · Discourse · Discourse

Lowjomaxrop · Published 2025-02-04 · Updated 2025-02-20 · CVE-2024-56197

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest stable, beta, and tests-passed versions

Description Discourse is an open source platform for community discussion. Private message titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the private message has been tagged.

Recommendations For versions prior to the latest stable, beta, and tests-passed versions, update to the latest version. For users unable to update, remove all groups from the "PM tags allowed for groups" option as a temporary workaround.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2024-56197

CVE-2024-56197

GHSA-XMGR-G9CP-V239

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56197.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-56197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56197 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2024-56197 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-xmgr-g9cp-v239 · Note
• https://twitter.com/CVEnew/status/1886891656164823449 · Twitter Post
• https://t.me/cvedetector/17250 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1886994369313493276 · Twitter Post