CVE-2021-37693: Re-use of email tokens in Discourse
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2.7.8 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2.8.0.beta4
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37693?
CVE-2021-37693 has a medium severity rating due to potential issues related to email token generation and account verification.
How do I fix CVE-2021-37693?
To fix CVE-2021-37693, upgrade to Discourse version 2.7.8 or later, or 2.8.0-beta4 or later.
What systems are affected by CVE-2021-37693?
CVE-2021-37693 affects Discourse versions prior to 2.7.8 and 2.8.0-beta4, including beta versions of 2.8.0 up to beta3.
What are the potential impacts of CVE-2021-37693?
Exploiting CVE-2021-37693 may allow attackers to bypass email verification processes when adding additional email addresses to accounts.
Is CVE-2021-37693 related to email accounts in Discourse?
Yes, CVE-2021-37693 specifically involves vulnerabilities in the email verification process when adding additional email addresses to existing Discourse accounts.