// For flags

CVE-2021-32788

Post creator of a whisper post can be revealed to non-staff users in Discourse

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal message even though the whisper post cannot be seen by them. 2: When a whisper post is before the last post in a post stream, deleting the last post will result in the creator of the whisper post to be revealed to non-staff users as the last poster of the topic.

Discourse es una plataforma de debate de código abierto. En las versiones anteriores a 2.7.7 se presentan dos bugs que conllevaron a que el creador de una publicación whisper fuera revelado a usuarios que no eran del personal. 1: Unos usuarios del personal que crean una publicación whisper en un mensaje personal son revelados a participantes del mensaje personal que no son del personal, aunque la publicación whisper no puede ser vista por ellos. 2: Cuando una publicación whisper es anterior al último mensaje en un flujo de mensajes, eliminando la última publicación resultará en que el creador del mensaje whisper sea revelado a usuarios no pertenecientes al personal como el último mensaje del tema

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-05-12 CVE Reserved
  • 2021-07-27 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-668: Exposure of Resource to Wrong Sphere
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Discourse
Search vendor "Discourse"
Discourse
Search vendor "Discourse" for product "Discourse"
< 2.7.7
Search vendor "Discourse" for product "Discourse" and version " < 2.7.7"
-
Affected