Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-24824

Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known workarounds for this issue.

Published

2022-04-14T22:15:07.827

Last Modified

2024-11-21T06:51:10.793

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-829
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application discourse discourse < 2.8.3 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
Application discourse discourse 2.9.0 Yes
References