Vulnerability Description
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Discourse | Discourse | < 2.8.4 |
Related Weaknesses (CWE)
References
- https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027fPatchThird Party Advisory
- https://github.com/discourse/discourse/pull/17071PatchThird Party Advisory
- https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhqThird Party Advisory
- https://github.com/discourse/discourse/commit/ae6a9079436fb9b20fd051d25fb6d8027fPatchThird Party Advisory
- https://github.com/discourse/discourse/pull/17071PatchThird Party Advisory
- https://github.com/discourse/discourse/security/advisories/GHSA-5f4f-35fx-gqhqThird Party Advisory
FAQ
What is CVE-2022-31060?
CVE-2022-31060 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on logi...
How severe is CVE-2022-31060?
CVE-2022-31060 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31060?
Check the references section above for vendor advisories and patch information. Affected products include: Discourse Discourse.