SB2022092991 - Multiple vulnerabilities in Discourse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022092991

SB2022092991 - Multiple vulnerabilities in Discourse

Published: September 29, 2022 Updated: July 1, 2026

Security Bulletin ID SB2022092991
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2022-39385)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in private message topic participant handling when redeeming an invitation. A remote user can redeem an invitation to disclose sensitive information.

In rare cases, the user can be transparently added as a participant to multiple private message topics without notification.


2) Improper Authorization (CVE-ID: CVE-2022-39356)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to gain improper access to existing accounts.

The vulnerability exists due to improper authorization in invite link handling when processing invitation-based account access. A remote user can use an invitation link that is not restricted to a single invitee email address to gain improper access to existing accounts.

This issue does not allow access to administrator accounts.


3) Improper access control (CVE-ID: CVE-2022-39378)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in user badge display when showing badges associated with restricted topics. A remote attacker can view a badge linked to a restricted topic to disclose sensitive information.

Only the topic title associated with the badge is exposed, and this occurs when a badge was awarded based on activity in a topic with restricted access.


4) Input validation error (CVE-ID: CVE-2022-39232)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause a denial of service in the browser.

The vulnerability exists due to improper input validation in quote rendering when processing an incomplete quote. A remote attacker can supply a malformed quote to cause a denial of service in the browser.


5) Input validation error (CVE-ID: CVE-2022-39226)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the user profile location and website fields when processing user-supplied profile data. A remote user can submit excessively large text values to cause a denial of service.

Other users are affected when loading the crafted profile.


6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2022-39241)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information from internal network services.

The vulnerability exists due to insufficient server-side request forgery protections in Discourse server-side request handling when processing user-supplied URLs that trigger outbound connections to private IP addresses. A remote privileged user can send a specially crafted request to disclose sensitive information from internal network services.

Depending on the available privileges, exploitation may trigger HTTP GET or POST requests, and may also trigger git clone operations over HTTP or SSH. Response visibility is limited in some cases.


7) Improper access control (CVE-ID: CVE-2022-36068)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify themes via the API.

The vulnerability exists due to improper access control in the theme API when handling API requests. A remote privileged user can send crafted API requests to modify themes via the API.


8) Path traversal (CVE-ID: CVE-2022-36066)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to path traversal in archive extraction when processing a maliciously crafted Zip or Gzip Tar archive upload. A remote privileged user can upload a specially crafted archive to execute arbitrary code.

The issue allows writing files to arbitrary locations before code execution is triggered.


Remediation

Install update from vendor's website.

References