CVE-2022-36066

Katalog CVE

CVSS 7.2 · High EPSS 2,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada discourse. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

Rincian

Terbit di NVD

29 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/pull/18421 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmv advisory pihak ketiga