CVE-2021-37693

Katalog CVE

CVSS 7.5 · High EPSS 0,83%

Kerentanan Insufficient Session Expiration pada discourse. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.

Rincian

Terbit di NVD

13 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration
CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/fb14e50741a4880cda22244eded8858e2f5336ef patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-9377-96f4-cww4 advisory pihak ketiga