CVE-2022-21642
Assigner: GitHub_M
Published: 2022-01-05T19:05:10
State: PUBLISHED
affected: product: discourse
vendor: discourse
versions: status: affected
version: < 2.7.13
status: affected
version: < 2.8.0.beta11
descriptions: value: Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: advisory: GHSA-mx3h-vc7w-r9c6
discovery: UNKNOWN
title: Exposure of whisper participants in discourse