CVE-2022-24850
Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by
Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category. As a result, a normal user is able to see whether a group has read/write permissions in the category even though the information should only be available to the users that can manage a category.
This issue is patched in the latest stable, beta and tests-passed versions of Discourse. There are no workarounds for this problem.
MEDIUM · CVSS 5.3
EPSS 0.00187
Schedule remediation
- SSVC automatable: yes - attacks can be scripted at scale
Sigma rules0
YARA rules0