What is CVE-2022-39378?

CVE-2022-39378 is a medium-severity vulnerability in Discourse, classified under Information Disclosure. CVSS score: 5.3/10. Published 2022-11-02.

How severe is CVE-2022-39378?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Discourse

CVE-2022-39378

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any user. If there are sensitive information in the topic title, it will therefore have been exposed. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are currently no known workarounds available.

Vulnerability class: Information Disclosure

EPSS: 0.005 (38.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Discourse — versions <= 2.9.0.beta10, <= 2.8.9, 2.9.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security-advisories@github.com (Third Party Advisory)

Frequently asked questions

What is CVE-2022-39378?: CVE-2022-39378 is a medium-severity vulnerability in Discourse, classified under Information Disclosure. CVSS score: 5.3/10. Published 2022-11-02.
How severe is CVE-2022-39378?: Medium severity. CVSS v3 base score is 5.3 out of 10.