CVE-2024-24748

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x	Third Party Advisory
https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193	Patch
https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::beta:::*
	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:3.2.0:beta1:::beta:::*
	cpe:2.3:a:discourse:discourse:3.2.0:beta2:::beta:::*
	cpe:2.3:a:discourse:discourse:3.2.0:beta3:::beta:::*
	cpe:2.3:a:discourse:discourse:3.2.0:beta4:::beta:::*
	cpe:2.3:a:discourse:discourse:3.3.0:beta1:::beta:::*

History

No history.

Information

Published : 2024-03-15 20:15

Updated : 2025-04-09 15:36

NVD link : CVE-2024-24748

Mitre link : CVE-2024-24748

CVE.ORG link : CVE-2024-24748

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2024-24748", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-03-15T20:15:07.677", "references": [{"url": "https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/discourse/discourse/commit/819361ba28f86a1347059af300bb5cca690f9193", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3qh8-xw23-cq4x", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Discourse es una plataforma de c\u00f3digo abierto para el debate comunitario. En las versiones afectadas, un atacante puede descubrir que existe una subcategor\u00eda secreta en una categor\u00eda p\u00fablica que no tiene subcategor\u00edas p\u00fablicas. El problema est\u00e1 solucionado en la \u00faltima versi\u00f3n estable, beta y probada de Discourse. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2025-04-09T15:36:23.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "307CBED3-4FDC-449C-A3C4-16FDE6EA4253", "versionEndIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "E60D37A5-1265-46BA-8CAC-F8C0F24BDEF8", "versionEndIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.2.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "1BFF647B-6CEF-43BF-BF5E-C82B557F78E2"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.2.0:beta2:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "10D931DE-F8F5-4A34-A30A-FDD4420ABD1A"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.2.0:beta3:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "C62C36D4-6CE7-4A57-BBF7-8066CFAE342A"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.2.0:beta4:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "84DF2347-8189-4983-BD23-3E43050C6795"}, {"criteria": "cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*", "vulnerable": true, "matchCriteriaId": "4FE1C6B5-D21B-46CC-A889-EECE10A7130A"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}