CVE-2021-41140

Reactions leak for secure category topics and private messages

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.

Discourse-reactions es un plugin para la plataforma Discourse que permite al usuario añadir sus reacciones al post. En las versiones afectadas, las reacciones dadas por el usuario a temas seguros y mensajes privados son visibles. Este problema está parcheado en la versión 0.2 de discourse-reactions. Se aconseja a los usuarios que no puedan actualizar, deshabilitar el plugin Discourse-reactions en el panel de administración

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-09-15 CVE Reserved
2021-10-19 CVE Published
2024-07-04 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

CAPEC

References (2)

URL	Tag	Source
https://github.com/discourse/discourse-reactions/security/advisories/GHSA-9358-hwg5-jrmh	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/discourse/discourse-reactions/commit/213d90b82fd15c4186ebc290fee18817d9727d0d	2022-08-12

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Discourse Search vendor "Discourse"		Discourse Reactions Search vendor "Discourse" for product "Discourse Reactions"				< 0.2 Search vendor "Discourse" for product "Discourse Reactions" and version " < 0.2"		discourse		Affected