CVE-2025-61598

Katalog CVE

CVSS 5.3 · Medium EPSS 0,30%

Kerentanan Use of Cache Containing Sensitive Information pada discourse. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

Rincian

Terbit di NVD

28 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-524: Use of Cache Containing Sensitive Information

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/3ea1b663c82c067e5ca778db846bad1e082ba6cd patch
• https://github.com/discourse/discourse/commit/fd567af7bf5a15c70772021acbdf5d38487a31bc patch
• https://github.com/discourse/discourse/security/advisories/GHSA-jp9x-wwv6-cv3j advisory pihak ketiga