CVE-2022-21677: Group advanced search option may leak group and group's members visibility
Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a group's visibility and the group's members visibility can be configured such that it is restricted to logged on users, members of the group or staff users. A vulnerability has been discovered in versions prior to 2.7.13 and 2.8.0.beta11 where the group advanced search option does not respect the group's visibility and members visibility level. As such, a group with restricted visibility or members visibility can be revealed through search with the right search option. This issue is patched in stable version 2.7.13, beta version 2.8.0.beta11, and tests-passed version 2.8.0.beta11 versions of Discourse. There are no workarounds aside from upgrading.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21677?
CVE-2022-21677 has a moderate severity level related to potential exposure of user visibility settings.
How do I fix CVE-2022-21677?
To fix CVE-2022-21677, upgrade to Discourse versions 2.8.0 or later, or apply the recommended patches.
What versions of Discourse are affected by CVE-2022-21677?
CVE-2022-21677 affects Discourse versions up to 2.7.12 and beta versions of 2.8.0 prior to the final release.
What impact does CVE-2022-21677 have on user privacy?
CVE-2022-21677 may lead to unauthorized visibility of group members and activities, impacting user privacy.
Is there a workaround for CVE-2022-21677?
A temporary workaround for CVE-2022-21677 is to manually adjust the visibility settings for newly created groups until the software is updated.