CVE-2022-46159
Any authenticated Discourse user can create an unlisted topic
Severity Score
4.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests-passed` branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take up unnecessary site resources. A patch for this issue is available in the `main` branch of Discourse. There are no known workarounds available.
Discourse es una plataforma de discusión de código abierto. En la versión 2.8.13 y anteriores en la rama `stable` y en la versión 2.9.0.beta14 y anteriores en las ramas `beta` y `tests-passed`, cualquier usuario autenticado puede crear un tema no listado. Estos temas, que no están disponibles para otros usuarios, pueden consumir recursos innecesarios del sitio. Hay un parche para este problema disponible en la rama "principal" de Discourse. No se conocen workarounds disponibles.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-11-28 CVE Reserved
- 2022-12-02 CVE Published
- 2024-06-24 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-qf99-xpx6-hgxp | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/discourse/discourse/commit/0ce38bd7bce862db251b882613ab7053ca777382 | 2023-11-07 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | <= 2.8.13 Search vendor "Discourse" for product "Discourse" and version " <= 2.8.13" | - |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta1 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta10 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta11 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta12 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta13 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta14 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta2 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta3 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta4 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta5 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta6 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta7 |
Affected
| ||||||
| Discourse Search vendor "Discourse" | Discourse Search vendor "Discourse" for product "Discourse" | 2.9.0 Search vendor "Discourse" for product "Discourse" and version "2.9.0" | beta8 |
Affected
| ||||||