CVE-2021-43850

Katalog CVE

CVSS 6.8 · Medium EPSS 0,83%

Kerentanan Improper Input Validation pada discourse. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_diagnostics` path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the `/message-bus/_diagnostics` path. The problem has been patched. Please upgrade to 2.8.0.beta10 or 2.7.12. No workarounds for this issue exist.

Rincian

Terbit di NVD

4 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/7a8ec129fb54f188b2da6588c9d24d3a36eb0d39 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-59jr-pj65-qmvr exploit · advisory pihak ketiga