Information disclosure in Discourse

CVE-2022-39378

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any user. If there are sensitive information in the topic title, it will therefore have been exposed. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are currently no known workarounds available.

Vulnerability class: Information Disclosure

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (42.0th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 42.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-39378: held from 0.005 to 0.005.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

  • Discourse — versions <= 2.9.0.beta10, <= 2.8.9, 2.9.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2022-39378?
CVE-2022-39378 is a medium-severity vulnerability in Discourse, classified under Information Disclosure. CVSS score: 5.3/10. Published 2022-11-02.
How severe is CVE-2022-39378?
Medium severity. CVSS v3 base score is 5.3 out of 10.