BIT-discourse-2021-41271

vendorUSosv

Cache poisoning via maliciously-formed request in discourse

view advisory published 2024-03-06Licence: per source

Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41271US	medium5.3	0.97% (62nd)	—	2021-11-15
Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could…

references

External citations — patches, advisories, analysis.

https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1ADVISORY
https://github.com/discourse/discourse/security/advisories/GHSA-hf6r-mc9j-hf4pADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-41271WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan