Exposición de Discourse

Message boards
72
score de exposición
2443
sitios usan
0
en explotación
2
críticos
Análisis Vexday

Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.

CVEs

259 resultados
CVE-2024-53991HIGHPotential Backup file leaked via Nginx in DiscourseEPSS 26.8%CVE-2021-41163CRITICALRCE via malicious SNS subscription payloadEPSS 19.8%CVE-2026-28227LOWDiscourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_categoryEPSS 2.8%CVE-2023-45131HIGHUnauthenticated access to new private chat messages in DiscourseEPSS 1.8%CVE-2021-41082HIGHPrivate message title and participating users leaked in discourseEPSS 1.8%CVE-2024-47773HIGHAnonymous cache poisoning via XHR requests in DiscourseEPSS 1.7%CVE-2022-36066CRITICALDiscourse vulnerable to RCE via admins uploading maliciously zipped fileEPSS 1.6%CVE-2022-21677MEDIUMGroup advanced search option may leak group and group's members visibility EPSS 1.2%CVE-2022-23641MEDIUMDenial of Service in DiscourseEPSS 1.2%CVE-2019-1020018—Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.EPSS 1.1%CVE-2021-43794MEDIUMAnonymous user cache poisoning via development-mode header in DiscourseEPSS 1.0%CVE-2022-31060MEDIUMBanner topic data is exposed on login-required Discourse sitesEPSS 1.0%CVE-2022-39232MEDIUMDiscourse vulnerable to incomplete quote causing a topic to crash in the browserEPSS 1.0%CVE-2023-45806MEDIUMDiscourse vulnerable to DoS via Regexp Injection in Full NameEPSS 1.0%CVE-2023-47120HIGHDiscourse DoS through Onebox favicon URLEPSS 1.0%CVE-2022-24824MEDIUMAnonymous user cache poisoning in discourseEPSS 1.0%CVE-2022-24782MEDIUMSecure category names leaked via user activity export in DiscourseEPSS 0.9%CVE-2023-47119MEDIUMHTML injection in oneboxed linksEPSS 0.9%CVE-2021-41271MEDIUMCache poisoning via maliciously-formed request in discourseEPSS 0.9%CVE-2022-31025LOWInvite bypasses user approval in DiscourseEPSS 0.9%