CVE-2022-21678
13.01.2022, 18:15
Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.Enginsight
| Vendor | Product | Version |
|---|---|---|
| discourse | discourse | 𝑥 < 2.7.13 |
| discourse | discourse | 2.8.0:beta1 |
| discourse | discourse | 2.8.0:beta10 |
| discourse | discourse | 2.8.0:beta2 |
| discourse | discourse | 2.8.0:beta3 |
| discourse | discourse | 2.8.0:beta4 |
| discourse | discourse | 2.8.0:beta5 |
| discourse | discourse | 2.8.0:beta6 |
| discourse | discourse | 2.8.0:beta7 |
| discourse | discourse | 2.8.0:beta8 |
| discourse | discourse | 2.8.0:beta9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References