Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.
References
Link | Resource |
---|---|
https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027f0ec59a | Patch Third Party Advisory |
https://github.com/discourse/discourse/pull/17071 | Patch Third Party Advisory |
https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhq | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-06-14T20:15:17
Updated: 2022-06-14T20:15:16
Reserved: 2022-05-18T00:00:00
Link: CVE-2022-31060
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-06-14T21:15:16.317
Modified: 2022-06-27T17:20:14.377
Link: CVE-2022-31060
JSON object: View
Redhat Information
No data.