CVE-2022-46168: Group SMTP user emails are exposed in CC email header
First published: Thu Jan 05 2023(Updated: )
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and `tests-passed` branches, recipients of a group SMTP email could see the email addresses of all other users inside the group SMTP topic. Most of the time this is not an issue as they are likely already familiar with one another's email addresses. This issue is patched in versions 2.8.14 and 2.9.0.beta15. The fix is that someone sending emails out via group SMTP to non-staged users masks those emails with blind carbon copy (BCC). Staged users are ones that have likely only interacted with the group via email, and will likely include other people who were CC'd on the original email to the group. As a workaround, disable group SMTP for any groups that have it enabled.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Discourse | <2.8.14 | |
| Discourse | =2.9.0-beta1 | |
| Discourse | =2.9.0-beta10 | |
| Discourse | =2.9.0-beta11 | |
| Discourse | =2.9.0-beta12 | |
| Discourse | =2.9.0-beta13 | |
| Discourse | =2.9.0-beta14 | |
| Discourse | =2.9.0-beta2 | |
| Discourse | =2.9.0-beta3 | |
| Discourse | =2.9.0-beta4 | |
| Discourse | =2.9.0-beta5 | |
| Discourse | =2.9.0-beta6 | |
| Discourse | =2.9.0-beta7 | |
| Discourse | =2.9.0-beta8 | |
| Discourse | =3.0.0-beta15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability identified by CVE-2022-46168?
CVE-2022-46168 is a vulnerability in Discourse that allows recipients of a group SMTP email to see the email addresses of all other users within the same group.
What is the severity of CVE-2022-46168?
The severity rating for CVE-2022-46168 has not been explicitly classified, but it poses privacy risks for email addresses.
How do I fix CVE-2022-46168?
To address CVE-2022-46168, upgrade Discourse to version 2.8.14 or higher on the stable branch or version 2.9.0.beta15 or higher on the beta and tests-passed branches.
What versions of Discourse are affected by CVE-2022-46168?
CVE-2022-46168 affects Discourse versions prior to 2.8.14 on stable and certain beta versions before 2.9.0.beta15.
Is CVE-2022-46168 a remote code execution vulnerability?
No, CVE-2022-46168 is not a remote code execution vulnerability; it primarily concerns the exposure of email addresses.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/remedy
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/discourse
- canonical/discourse
- version/discourse/2.9.0-beta1
- version/discourse/2.9.0-beta10
- version/discourse/2.9.0-beta11
- version/discourse/2.9.0-beta12
- version/discourse/2.9.0-beta13
- version/discourse/2.9.0-beta14
- version/discourse/2.9.0-beta2
- version/discourse/2.9.0-beta3
- version/discourse/2.9.0-beta4
- version/discourse/2.9.0-beta5
- version/discourse/2.9.0-beta6
- version/discourse/2.9.0-beta7
- version/discourse/2.9.0-beta8
- version/discourse/3.0.0-beta15