CVE-2022-24782

Katalog CVE

CVSS 4.3 · Medium EPSS 0,97%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the `main` branch of Discourse's GitHub repository and is anticipated to be part of future releases.

Rincian

Terbit di NVD

24 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,97% peluang dieksploitasi; lebih tinggi dari 60,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/pull/16273 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343 advisory pihak ketiga