CVE-2025-64528

Katalog CVE

CVSS 5.3 · Medium EPSS 0,29%

Kerentanan Exposure of Sensitive Information Through Data Queries pada discourse. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when `enable_names` is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix.

Rincian

Terbit di NVD

30 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-202: Exposure of Sensitive Information Through Data Queries

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/commit/1cb45b8b287597085e3514596ffb1d9b41938f81 patch
• https://github.com/discourse/discourse/commit/6192f55629624925595dae14364fd86cac0f09df patch
• https://github.com/discourse/discourse/commit/e936a523b5900a9d866d23ea3da904ba12bb0fb2 patch
• https://github.com/discourse/discourse/security/advisories/GHSA-c59w-jwx7-34v4 advisory pihak ketiga