CVE-2022-21642

EUVD-2022-26866
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub_MCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
discoursediscourse
𝑥
< 2.7.13
discoursediscourse
2.8.0:beta1
discoursediscourse
2.8.0:beta10
discoursediscourse
2.8.0:beta2
discoursediscourse
2.8.0:beta3
discoursediscourse
2.8.0:beta4
discoursediscourse
2.8.0:beta5
discoursediscourse
2.8.0:beta6
discoursediscourse
2.8.0:beta7
discoursediscourse
2.8.0:beta8
discoursediscourse
2.8.0:beta9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/discourse/discourse/commit/702685b6a06ae45a544fc702027f1e4573d94aaa
https://github.com/discourse/discourse/security/advisories/GHSA-mx3h-vc7w-r9c6
https://github.com/discourse/discourse/commit/702685b6a06ae45a544fc702027f1e4573d94aaa
https://github.com/discourse/discourse/security/advisories/GHSA-mx3h-vc7w-r9c6