CVE-2021-41082

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participating user exposed to users that do not have access to the private messages. However, access control for the private messages was not compromised as users were not able to view the posts in the leaked private message despite seeing it in their inbox. The problematic commit was reverted around 32 minutes after it was made. Users are encouraged to upgrade to the latest commit if they are running Discourse against the `tests-passed` branch.

Rincian

Terbit di NVD

20 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-863: Incorrect Authorization

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/27bad28c530c89acab35a56b945b6a3924280f4b patch · advisory pihak ketiga
• https://github.com/discourse/discourse/commit/ddb458343dc39a7a8c99467dcd809b444514fe2c patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-vm3x-w6jm-j9vv advisory pihak ketiga