CVE-2022-31060: Banner topic data is exposed on login-required Discourse sites
First published: Tue Jun 14 2022(Updated: )
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branches of Discourse. As a workaround, one may disable banners.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse | <2.8.4 | |
| Discourse | =2.9.0-beta1 | |
| Discourse | =2.9.0-beta2 | |
| Discourse | =2.9.0-beta3 | |
| Discourse | =2.9.0-beta4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-31060?
CVE-2022-31060 has a medium severity level due to the exposure of sensitive banner topic data on login-required Discourse sites.
How do I fix CVE-2022-31060?
To fix CVE-2022-31060, you should upgrade your Discourse installation to version 2.8.4 or later in the stable branch, or version 2.9.0.beta5 or later in the beta branch.
Which Discourse versions are affected by CVE-2022-31060?
CVE-2022-31060 affects Discourse versions prior to 2.8.4 in the stable branch and any beta versions before 2.9.0.beta5.
What does CVE-2022-31060 vulnerability expose?
CVE-2022-31060 exposes banner topic data on Discourse sites that require user login, potentially risking user privacy.
Is there a workaround for CVE-2022-31060?
No official workaround for CVE-2022-31060 exists, so upgrading to the patched versions is necessary for protection.
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/title
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/discourse
- canonical/discourse
- version/discourse/2.9.0-beta1
- version/discourse/2.9.0-beta2
- version/discourse/2.9.0-beta3
- version/discourse/2.9.0-beta4