CVE-2021-41140: Reactions leak for secure category topics and private messages
Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41140?
CVE-2021-41140 is a moderate severity vulnerability affecting the Discourse Reactions plugin.
How do I fix CVE-2021-41140?
To fix CVE-2021-41140, upgrade to version 0.2 or later of the Discourse Reactions plugin.
What does CVE-2021-41140 vulnerability entail?
CVE-2021-41140 enables user reactions to secure topics and private messages to be visible to unauthorized users.
Which versions of Discourse Reactions are affected by CVE-2021-41140?
CVE-2021-41140 affects all versions of Discourse Reactions prior to version 0.2.
Is there a patch available for CVE-2021-41140?
Yes, a patch for CVE-2021-41140 was included in version 0.2 of the Discourse Reactions plugin.