CVE-2024-45051

Oct. 19, 2024, 1:11 a.m.

CVSS Score

8.2 / 10

Products Impacted

Vendor	Product	Versions
discourse	discourse	*, 3.4.0

Description

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

Weaknesses

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE ID: 287

Date

Published: Oct. 7, 2024, 9:15 p.m.

Last Modified: Oct. 19, 2024, 1:11 a.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

CPEs

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	discourse	discourse	/	/	/	/	stable	/	/	/
a	discourse	discourse	/	/	/	/	beta	/	/	/
a	discourse	discourse	3.4.0	-	/	/	beta	/	/	/
a	discourse	discourse	3.4.0	beta1	/	/	beta	/	/	/

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact