Overview
- Description
- Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the `stable` branch and version `2.9.0.beta5` on the `beta` and `tests-passed` branches. As a workaround, disable invites or increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
- security-advisories@github.com
- CWE-285
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33A8F935-CC56-40AD-ADA9-C13AB1B1371A",
"versionEndExcluding": "2.8.4"
},
{
"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B3803EF9-A296-42B7-887F-93C5E68E94C4"
},
{
"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8BA3D313-3C11-43E2-A47D-CBB532D1B6F8"
},
{
"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F42673E-65F3-4807-9484-20CB747420FB"
},
{
"criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B91D023-FCE5-4866-AD8B-BBB675763104"
}
],
"operator": "OR"
}
]
}
]