Medium severity6.8NVD Advisory· Published Jan 4, 2022· Updated Jun 17, 2026
CVE-2021-43850
CVE-2021-43850
Description
Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the /message-bus/_diagnostics path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the /message-bus/_diagnostics path. The problem has been patched. Please upgrade to 2.8.0.beta10 or 2.7.12. No workarounds for this issue exist.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*range: <2.7.12
- cpe:2.3:a:discourse:discourse:2.8.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta5:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta6:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta7:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta8:*:*:*:*:*:*
- cpe:2.3:a:discourse:discourse:2.8.0:beta9:*:*:*:*:*:*
- (no CPE)range: before 2.8.0.beta10 or 2.7.12
- (no CPE)range: < 2.7.12
Patches
Vulnerability mechanics
References
2- github.com/discourse/discourse/commit/7a8ec129fb54f188b2da6588c9d24d3a36eb0d39nvdPatchThird Party Advisory
- github.com/discourse/discourse/security/advisories/GHSA-59jr-pj65-qmvrnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.