CVE-2022-31095mediumCWE-200

CVE-2022-31095: medium-severity vulnerability in discourse-chat

Exposure of Sensitive Information in discourse-chat

Published · Updated

Follow this CVE+ Monitor discourse-chat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.6%
discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily affecting direct message channels. There are no known workarounds for this issue, and users are advised to update the plugin.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
discourse · discourse-chat
Related CVEs — discourse-chat

In the same product, most dangerous first.

CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2022-39279MEDIUMDiscourse-chat plugin susceptible to XSS in channel name and descriptionEPSS 0.5%