CVE-2022-24804mediumCWE-200

CVE-2022-24804: fallo de gravedad media en discourse

Private group name exposure in discourse

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear discourse

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.9%
Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permissions setting.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
discourse · discourse
CVEs relacionadas — discourse

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-53991HIGHPotential Backup file leaked via Nginx in DiscourseEPSS 29.9%CVE-2021-41163CRITICALRCE via malicious SNS subscription payloadEPSS 19.8%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 4.0%CVE-2026-28227LOWDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_categoryEPSS 3.2%CVE-2022-36066CRITICALDiscourse vulnerable to RCE via admins uploading maliciously zipped fileEPSS 2.1%CVE-2024-47773HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 1.8%