1. Home
  2. CVE Database
  3. CVE-2022-31095
MEDIUM · 4.3

CVE-2022-31095

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel th...

Vulnerability Description

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily affecting direct message channels. There are no known workarounds for this issue, and users are advised to update the plugin.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
DiscourseDiscourse-Chat< 0.4

Related Weaknesses (CWE)

CWE-200CWE-862

References

FAQ

What is CVE-2022-31095?

CVE-2022-31095 is a vulnerability with a CVSS score of 4.3 (MEDIUM). discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel th...

How severe is CVE-2022-31095?

CVE-2022-31095 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-31095?

Check the references section above for vendor advisories and patch information. Affected products include: Discourse Discourse-Chat.