CVE-2022-31060: Banner topic data is exposed on login-required Discourse sites
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches of Discourse. As a workaround, one may disable banners.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31060?
CVE-2022-31060 has a medium severity level due to the exposure of sensitive banner topic data on login-required Discourse sites.
How do I fix CVE-2022-31060?
To fix CVE-2022-31060, you should upgrade your Discourse installation to version 2.8.4 or later in the stable branch, or version 2.9.0.beta5 or later in the beta branch.
Which Discourse versions are affected by CVE-2022-31060?
CVE-2022-31060 affects Discourse versions prior to 2.8.4 in the stable branch and any beta versions before 2.9.0.beta5.
What does CVE-2022-31060 vulnerability expose?
CVE-2022-31060 exposes banner topic data on Discourse sites that require user login, potentially risking user privacy.
Is there a workaround for CVE-2022-31060?
No official workaround for CVE-2022-31060 exists, so upgrading to the patched versions is necessary for protection.