CVE-2022-24824

Published: Apr 14, 2022

Modified: Apr 23, 2025

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known workarounds for this issue.

Vendor	Product	Versions
discourse	discourse	affected `< 2.8.3` affected `< 2.9.0.beta4`

Weaknesses (CWE)

CWE-829

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

https://github.com/discourse/discourse/security/advisories/GHSA-46v9-3jc4-f53w

x_refsource_CONFIRM

https://github.com/discourse/discourse/commit/b72b0dac10493d09f4f9eb8f3c3ce7817295e34e

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2022-24824

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References