CVE-2022-23546: Discourse vulnerable to private topic leak via email#send_digest
Published Jan 5, 2023
·Updated
In version 2.9.0.beta14 of Discourse, an open-source discussion platform, maliciously embedded urls can leak an admin's digest of recent topics, possibly exposing private information. A patch is available for version 2.9.0.beta15. There are no known workarounds for this issue.
Affected Software
14 affected components
Discourse Discourse<2.9.0
Discourse Discourse=2.9.0-beta1
Discourse Discourse=2.9.0-beta10
Discourse Discourse=2.9.0-beta11
Discourse Discourse=2.9.0-beta12
Discourse Discourse=2.9.0-beta13
Discourse Discourse=2.9.0-beta14
Discourse Discourse=2.9.0-beta2
Discourse Discourse=2.9.0-beta3
Discourse Discourse=2.9.0-beta4
Discourse Discourse=2.9.0-beta5
Discourse Discourse=2.9.0-beta6
Discourse Discourse=2.9.0-beta7
Discourse Discourse=2.9.0-beta8
Remediation
Event History
Jan 5, 2023
CVE Published
via MITRE·06:10 PM
Data Sourced
via MITRE·06:10 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-23546?
CVE-2022-23546 is a vulnerability in version 2.9.0.beta14 of Discourse, an open-source discussion platform, that can leak an admin's digest of recent topics through maliciously embedded URLs.
2
How severe is CVE-2022-23546?
CVE-2022-23546 has a severity rating of 5.5 (medium).
3
Which software versions are affected by CVE-2022-23546?
Version 2.9.0.beta14 of Discourse is affected by CVE-2022-23546.
4
Is there a patch available for CVE-2022-23546?
Yes, a patch is available for version 2.9.0.beta15 of Discourse to fix CVE-2022-23546.
5
Are there any known workarounds for CVE-2022-23546?
No, there are no known workarounds for CVE-2022-23546.