CVE-2022-24824

Katalog CVE

CVSS 5.3 · Medium EPSS 1,0%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada discourse. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known workarounds for this issue.

Rincian

Terbit di NVD

14 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/b72b0dac10493d09f4f9eb8f3c3ce7817295e34e patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-46v9-3jc4-f53w advisory pihak ketiga