CVE-2022-31184

Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub_MCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
discoursediscourse
𝑥
≤ 2.8.6
discoursediscourse
2.9.0:beta1
discoursediscourse
2.9.0:beta2
discoursediscourse
2.9.0:beta3
discoursediscourse
2.9.0:beta4
discoursediscourse
2.9.0:beta5
discoursediscourse
2.9.0:beta6
discoursediscourse
2.9.0:beta7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0
https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrf
https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0
https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrf