VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Mar 15, 2024· Updated Jun 17, 2026

CVE-2024-28242

CVE-2024-28242

Description

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.

Affected products

7
  • Discourse (software)/Discourse6 versions
    cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*+ 5 more
    • cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*range: <3.3.0
    • cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*range: <3.2.0
    • cpe:2.3:a:discourse:discourse:3.3.0:-:*:*:beta:*:*:*
    • cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
    • (no CPE)
    • (no CPE)range: stable <= 3.2.0
  • osv-coords
    pkg:bitnami/discourse
    Range: < 3.2.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.