CVE-2021-43794

Katalog CVE

CVSS 5.3 · Medium EPSS 1,1%

Kerentanan Externally Controlled Reference to a Resource in Another Sphere pada discourse. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Rincian

Terbit di NVD

1 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-249g-pc77-65hp advisory pihak ketiga