CVE-2021-43792

 

Published at: - 01-12-2021 09:15

Last modified: - 10-01-2023 06:04

Total changes: - 5

Description

Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4
• https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522
• https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895

 

Keywords

NVD

 

CVE-2021-43792

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures