CVE-2022-31060

discourse/discourse

on github

Published

June 14, 2022

Severity

CVSS v3:

5.3 MEDIUM

CVSS v2:

5 MEDIUM

Description

Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.

References

https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027f0ec59a
https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhq
https://github.com/discourse/discourse/pull/17071

Configurations

CPE23	Version Start	Version End	Exact Version
cpe:2.3:a:discourse:discourse:2.9.0:beta1::::::	n/a	n/a	2.9.0
cpe:2.3:a:discourse:discourse:2.9.0:beta2::::::	n/a	n/a	2.9.0
cpe:2.3:a:discourse:discourse:2.9.0:beta3::::::	n/a	n/a	2.9.0
cpe:2.3:a:discourse:discourse::::::::	n/a	2.8.4	*
cpe:2.3:a:discourse:discourse:2.9.0:beta4::::::	n/a	n/a	2.9.0

External Links

NVD - CVE-2022-31060