CVE-2022-21678

User's bio visible even if profile is restricted in Discourse

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.

Discourse es una plataforma de debate de código abierto. En versiones anteriores a 2.8.0.beta11 en la rama "tests-passed", la versión 2.8.0.beta11 en la rama "beta", y la versión 2.7.13 en la rama "stable", las biografías de los usuarios que hacían sus perfiles privados seguían siendo visibles en las etiquetas "(meta)" de sus páginas de usuario. El problema está parcheado en la versión 2.8.0.beta11 de "tests-passed", la versión 2.8.0.beta11 de "beta" y la versión 2.7.13 de "stable" de Discourse

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-16 CVE Reserved
2022-01-13 CVE Published
2023-08-06 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-863: Incorrect Authorization

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6de	2023-07-24
https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6c	2023-07-24
https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564m	2023-07-24

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				< 2.7.13 Search vendor "Discourse" for product "Discourse" and version " < 2.7.13"		-		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta1		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta10		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta2		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta3		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta4		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta5		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta6		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta7		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta8		Affected
Discourse Search vendor "Discourse"		Discourse Search vendor "Discourse" for product "Discourse"				2.8.0 Search vendor "Discourse" for product "Discourse" and version "2.8.0"		beta9		Affected