CVE-2022-24782
Description
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the main branch of Discourse's GitHub repository and is anticipated to be part of future releases.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*range: <=2.8.2
- (no CPE)range: <=2.8.2 (stable), <=2.9.0.beta3 (beta), <=2.9.0.beta3 (tests-passed)
- (no CPE)range: stable <= 2.8.2
Patches
Vulnerability mechanics
References
3- github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356nvdPatchThird Party Advisory
- github.com/discourse/discourse/pull/16273nvdPatchThird Party Advisory
- github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343nvdThird Party Advisory
News mentions
0No linked articles in our index yet.