CVE-2022-24824: Anonymous user cache poisoning in discourse
Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown the crawler view of the site instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24824?
CVE-2022-24824 is classified as a medium severity vulnerability.
How do I fix CVE-2022-24824?
To fix CVE-2022-24824, upgrade Discourse to version 2.8.3 or later, or to a non-beta version of 2.9.0.
Who is affected by CVE-2022-24824?
CVE-2022-24824 affects anonymous users of the Discourse platform in specific vulnerable versions.
What kind of attack does CVE-2022-24824 enable?
CVE-2022-24824 allows attackers to poison the cache for anonymous users, potentially causing a partial denial-of-service.
Are there any known exploits for CVE-2022-24824?
As of now, there are no publicly disclosed exploits for CVE-2022-24824.