Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` branches, inviting users on sites that use single sign-on could bypass the `must_approve_users` check and invites by staff are always approved automatically. The issue is patched in Discourse version 2.8.4 on the `stable` branch and version `2.9.0.beta5` on the `beta` and `tests-passed` branches. As a workaround, disable invites or increase `min_trust_level_to_allow_invite` to reduce the attack surface to more trusted users.
References
Link | Resource |
---|---|
https://github.com/discourse/discourse/commit/0fa0094531efc82d9371f90a02aa804b176d59cf | Patch Third Party Advisory |
https://github.com/discourse/discourse/commit/7c4e2d33fa4b922354c177ffc880a2f2701a91f9 | Patch Third Party Advisory |
https://github.com/discourse/discourse/pull/16974 | Patch Third Party Advisory |
https://github.com/discourse/discourse/pull/16984 | Patch Third Party Advisory |
https://github.com/discourse/discourse/security/advisories/GHSA-x7jh-mx5q-6f9q | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Jul 2023, 17:09
Type | Values Removed | Values Added |
---|---|---|
CWE | NVD-CWE-Other |
14 Jun 2022, 17:08
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://github.com/discourse/discourse/pull/16974 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/discourse/discourse/commit/0fa0094531efc82d9371f90a02aa804b176d59cf - Patch, Third Party Advisory | |
References | (MISC) https://github.com/discourse/discourse/commit/7c4e2d33fa4b922354c177ffc880a2f2701a91f9 - Patch, Third Party Advisory | |
References | (CONFIRM) https://github.com/discourse/discourse/security/advisories/GHSA-x7jh-mx5q-6f9q - Third Party Advisory | |
References | (MISC) https://github.com/discourse/discourse/pull/16984 - Patch, Third Party Advisory | |
CPE | cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:* cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:* cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:* |
|
First Time |
Discourse discourse
Discourse |
|
CWE | CWE-863 | |
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
07 Jun 2022, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-07 15:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-31025
Mitre link : CVE-2022-31025
CVE.ORG link : CVE-2022-31025
JSON object : View
Products Affected
discourse
- discourse
CWE