CVE-2024-36122

Katalog CVE

CVSS 4.3 · Medium EPSS 0,37%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. As possible workarounds, either prevent moderators from accessing the review queue or disable the approve suspect users site setting and the must approve users site setting to prevent users from being added to the review queue.

Rincian

Terbit di NVD

3 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/8d5b21170efa4766e1a213ff07dc36d36cf3dfb4 patch
• https://github.com/discourse/discourse/commit/e2a7265dba3d9e943338db21ca38c50276b22f47 patch
• https://github.com/discourse/discourse/security/advisories/GHSA-rr93-hcw4-cv3f advisory pihak ketiga