CVE-2024-31219mediumCWE-200

CVE-2024-31219: falha de média gravidade em discourse-reactions

Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar discourse-reactions

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
discourse · discourse-reactions
CVEs relacionadas — discourse-reactions

No mesmo produto, das mais perigosas para as menos.

CVE-2021-41140MEDIUMReactions leak for secure category topics and private messagesEPSS 0.9%CVE-2023-30611MEDIUMReaction metadata exposed in private topics in Discourse-reactionsEPSS 0.4%CVE-2023-49098LOWReaction data for user notifications exposed in Discourse-reactionsEPSS 0.3%