CVE-2022-39232

Katalog CVE

CVSS 4.3 · Medium EPSS 1,2%

Kerentanan Improper Input Validation pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.

Rincian

Terbit di NVD

29 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/eab33af5bf19827527fe79134d865b5c727f6530 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/pull/18311 patch · advisory pihak ketiga
• https://github.com/discourse/discourse/security/advisories/GHSA-cv64-v73f-7wq5 advisory pihak ketiga