BIT-discourse-2022-21642

vendorUSosv

Exposure of whisper participants in discourse

view advisory published 2024-03-06Licence: per source

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-21642US	medium4.3	0.73% (54th)	—	2022-01-05
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants.…

references

External citations — patches, advisories, analysis.

https://github.com/discourse/discourse/commit/702685b6a06ae45a544fc702027f1e4573d94aaaADVISORY
https://github.com/discourse/discourse/security/advisories/GHSA-mx3h-vc7w-r9c6ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-21642WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan