BIT-discourse-2022-46177

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2022-46177.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-discourse-2022-46177
Aliases
Published
2024-03-06T11:02:19.390Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old reset email is used to reset the password, the Discourse account's primary email would be re-linked to the old email. If the old email address is compromised or has transferred ownership, this leads to an account takeover. This is however mitigated by the SiteSetting email_token_valid_hours which is currently 48 hours. Users should upgrade to versions 2.8.14 or 3.0.0.beta15 to receive a patch. As a workaround, lower email_token_valid_hours as needed.

References

Affected packages

Bitnami / discourse

Package

Name
discourse
Purl
pkg:bitnami/discourse

Severity

  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.8.14
Type
SEMVER
Events
Introduced
1.1.0-beta1
Last affected
1.1.0-beta1
Introduced
1.1.0-beta2
Last affected
1.1.0-beta2
Introduced
1.1.0-beta3
Last affected
1.1.0-beta3
Introduced
1.1.0-beta4
Last affected
1.1.0-beta4
Introduced
1.1.0-beta5
Last affected
1.1.0-beta5
Introduced
1.1.0-beta6
Last affected
1.1.0-beta6
Introduced
1.1.0-beta6b
Last affected
1.1.0-beta6b
Introduced
1.1.0-beta7
Last affected
1.1.0-beta7
Introduced
1.1.0-beta8
Last affected
1.1.0-beta8
Introduced
1.2.0-beta1
Last affected
1.2.0-beta1
Introduced
1.2.0-beta2
Last affected
1.2.0-beta2
Introduced
1.2.0-beta3
Last affected
1.2.0-beta3
Introduced
1.2.0-beta4
Last affected
1.2.0-beta4
Introduced
1.2.0-beta5
Last affected
1.2.0-beta5
Introduced
1.2.0-beta6
Last affected
1.2.0-beta6
Introduced
1.2.0-beta7
Last affected
1.2.0-beta7
Introduced
1.2.0-beta8
Last affected
1.2.0-beta8
Introduced
1.2.0-beta9
Last affected
1.2.0-beta9
Introduced
1.3.0-beta1
Last affected
1.3.0-beta1
Introduced
1.3.0-beta10
Last affected
1.3.0-beta10
Introduced
1.3.0-beta11
Last affected
1.3.0-beta11
Introduced
1.3.0-beta2
Last affected
1.3.0-beta2
Introduced
1.3.0-beta3
Last affected
1.3.0-beta3
Introduced
1.3.0-beta4
Last affected
1.3.0-beta4
Introduced
1.3.0-beta5
Last affected
1.3.0-beta5
Introduced
1.3.0-beta6
Last affected
1.3.0-beta6
Introduced
1.3.0-beta7
Last affected
1.3.0-beta7
Introduced
1.3.0-beta8
Last affected
1.3.0-beta8
Introduced
1.3.0-beta9
Last affected
1.3.0-beta9
Introduced
1.4.0-beta1
Last affected
1.4.0-beta1
Introduced
1.4.0-beta10
Last affected
1.4.0-beta10
Introduced
1.4.0-beta11
Last affected
1.4.0-beta11
Introduced
1.4.0-beta12
Last affected
1.4.0-beta12
Introduced
1.4.0-beta2
Last affected
1.4.0-beta2
Introduced
1.4.0-beta3
Last affected
1.4.0-beta3
Introduced
1.4.0-beta4
Last affected
1.4.0-beta4
Introduced
1.4.0-beta5
Last affected
1.4.0-beta5
Introduced
1.4.0-beta6
Last affected
1.4.0-beta6
Introduced
1.4.0-beta7
Last affected
1.4.0-beta7
Introduced
1.4.0-beta8
Last affected
1.4.0-beta8
Introduced
1.4.0-beta9
Last affected
1.4.0-beta9
Introduced
1.5.0-beta1
Last affected
1.5.0-beta1
Introduced
1.5.0-beta10
Last affected
1.5.0-beta10
Introduced
1.5.0-beta11
Last affected
1.5.0-beta11
Introduced
1.5.0-beta12
Last affected
1.5.0-beta12
Introduced
1.5.0-beta13
Last affected
1.5.0-beta13
Introduced
1.5.0-beta13b
Last affected
1.5.0-beta13b
Introduced
1.5.0-beta14
Last affected
1.5.0-beta14
Introduced
1.5.0-beta2
Last affected
1.5.0-beta2
Introduced
1.5.0-beta3
Last affected
1.5.0-beta3
Introduced
1.5.0-beta4
Last affected
1.5.0-beta4
Introduced
1.5.0-beta5
Last affected
1.5.0-beta5
Introduced
1.5.0-beta6
Last affected
1.5.0-beta6
Introduced
1.5.0-beta7
Last affected
1.5.0-beta7
Introduced
1.5.0-beta8
Last affected
1.5.0-beta8
Introduced
1.5.0-beta9
Last affected
1.5.0-beta9
Introduced
1.6.0-beta1
Last affected
1.6.0-beta1
Introduced
1.6.0-beta10
Last affected
1.6.0-beta10
Introduced
1.6.0-beta11
Last affected
1.6.0-beta11
Introduced
1.6.0-beta12
Last affected
1.6.0-beta12
Introduced
1.6.0-beta2
Last affected
1.6.0-beta2
Introduced
1.6.0-beta3
Last affected
1.6.0-beta3
Introduced
1.6.0-beta4
Last affected
1.6.0-beta4
Introduced
1.6.0-beta5
Last affected
1.6.0-beta5
Introduced
1.6.0-beta6
Last affected
1.6.0-beta6
Introduced
1.6.0-beta7
Last affected
1.6.0-beta7
Introduced
1.6.0-beta8
Last affected
1.6.0-beta8
Introduced
1.6.0-beta9
Last affected
1.6.0-beta9
Introduced
1.7.0-beta1
Last affected
1.7.0-beta1
Introduced
1.7.0-beta10
Last affected
1.7.0-beta10
Introduced
1.7.0-beta11
Last affected
1.7.0-beta11
Introduced
1.7.0-beta2
Last affected
1.7.0-beta2
Introduced
1.7.0-beta3
Last affected
1.7.0-beta3
Introduced
1.7.0-beta4
Last affected
1.7.0-beta4
Introduced
1.7.0-beta5
Last affected
1.7.0-beta5
Introduced
1.7.0-beta6
Last affected
1.7.0-beta6
Introduced
1.7.0-beta7
Last affected
1.7.0-beta7
Introduced
1.7.0-beta8
Last affected
1.7.0-beta8
Introduced
1.7.0-beta9
Last affected
1.7.0-beta9
Introduced
1.8.0-beta1
Last affected
1.8.0-beta1
Introduced
1.8.0-beta10
Last affected
1.8.0-beta10
Introduced
1.8.0-beta11
Last affected
1.8.0-beta11
Introduced
1.8.0-beta12
Last affected
1.8.0-beta12
Introduced
1.8.0-beta13
Last affected
1.8.0-beta13
Introduced
1.8.0-beta2
Last affected
1.8.0-beta2
Introduced
1.8.0-beta3
Last affected
1.8.0-beta3
Introduced
1.8.0-beta4
Last affected
1.8.0-beta4
Introduced
1.8.0-beta5
Last affected
1.8.0-beta5
Introduced
1.8.0-beta6
Last affected
1.8.0-beta6
Introduced
1.8.0-beta7
Last affected
1.8.0-beta7
Introduced
1.8.0-beta8
Last affected
1.8.0-beta8
Introduced
1.8.0-beta9
Last affected
1.8.0-beta9
Introduced
1.9.0-beta1
Last affected
1.9.0-beta1
Introduced
1.9.0-beta10
Last affected
1.9.0-beta10
Introduced
1.9.0-beta11
Last affected
1.9.0-beta11
Introduced
1.9.0-beta12
Last affected
1.9.0-beta12
Introduced
1.9.0-beta13
Last affected
1.9.0-beta13
Introduced
1.9.0-beta14
Last affected
1.9.0-beta14
Introduced
1.9.0-beta15
Last affected
1.9.0-beta15
Introduced
1.9.0-beta16
Last affected
1.9.0-beta16
Introduced
1.9.0-beta17
Last affected
1.9.0-beta17
Introduced
1.9.0-beta2
Last affected
1.9.0-beta2
Introduced
1.9.0-beta3
Last affected
1.9.0-beta3
Introduced
1.9.0-beta4
Last affected
1.9.0-beta4
Introduced
1.9.0-beta5
Last affected
1.9.0-beta5
Introduced
1.9.0-beta6
Last affected
1.9.0-beta6
Introduced
1.9.0-beta7
Last affected
1.9.0-beta7
Introduced
1.9.0-beta8
Last affected
1.9.0-beta8
Introduced
1.9.0-beta9
Last affected
1.9.0-beta9
Introduced
2.0.0-beta1
Last affected
2.0.0-beta1
Introduced
2.0.0-beta10
Last affected
2.0.0-beta10
Introduced
2.0.0-beta2
Last affected
2.0.0-beta2
Introduced
2.0.0-beta3
Last affected
2.0.0-beta3
Introduced
2.0.0-beta4
Last affected
2.0.0-beta4
Introduced
2.0.0-beta5
Last affected
2.0.0-beta5
Introduced
2.0.0-beta6
Last affected
2.0.0-beta6
Introduced
2.0.0-beta7
Last affected
2.0.0-beta7
Introduced
2.0.0-beta8
Last affected
2.0.0-beta8
Introduced
2.0.0-beta9
Last affected
2.0.0-beta9
Introduced
2.1.0-beta1
Last affected
2.1.0-beta1
Introduced
2.1.0-beta2
Last affected
2.1.0-beta2
Introduced
2.1.0-beta3
Last affected
2.1.0-beta3
Introduced
2.1.0-beta4
Last affected
2.1.0-beta4
Introduced
2.1.0-beta5
Last affected
2.1.0-beta5
Introduced
2.1.0-beta6
Last affected
2.1.0-beta6
Introduced
2.2.0-beta1
Last affected
2.2.0-beta1
Introduced
2.2.0-beta10
Last affected
2.2.0-beta10
Introduced
2.2.0-beta2
Last affected
2.2.0-beta2
Introduced
2.2.0-beta3
Last affected
2.2.0-beta3
Introduced
2.2.0-beta4
Last affected
2.2.0-beta4
Introduced
2.2.0-beta5
Last affected
2.2.0-beta5
Introduced
2.2.0-beta6
Last affected
2.2.0-beta6
Introduced
2.2.0-beta7
Last affected
2.2.0-beta7
Introduced
2.2.0-beta8
Last affected
2.2.0-beta8
Introduced
2.2.0-beta9
Last affected
2.2.0-beta9
Introduced
2.3.0-beta1
Last affected
2.3.0-beta1
Introduced
2.3.0-beta10
Last affected
2.3.0-beta10
Introduced
2.3.0-beta11
Last affected
2.3.0-beta11
Introduced
2.3.0-beta2
Last affected
2.3.0-beta2
Introduced
2.3.0-beta3
Last affected
2.3.0-beta3
Introduced
2.3.0-beta4
Last affected
2.3.0-beta4
Introduced
2.3.0-beta5
Last affected
2.3.0-beta5
Introduced
2.3.0-beta6
Last affected
2.3.0-beta6
Introduced
2.3.0-beta7
Last affected
2.3.0-beta7
Introduced
2.3.0-beta8
Last affected
2.3.0-beta8
Introduced
2.3.0-beta9
Last affected
2.3.0-beta9
Introduced
2.4.0-beta1
Last affected
2.4.0-beta1
Introduced
2.4.0-beta10
Last affected
2.4.0-beta10
Introduced
2.4.0-beta11
Last affected
2.4.0-beta11
Introduced
2.4.0-beta2
Last affected
2.4.0-beta2
Introduced
2.4.0-beta3
Last affected
2.4.0-beta3
Introduced
2.4.0-beta4
Last affected
2.4.0-beta4
Introduced
2.4.0-beta5
Last affected
2.4.0-beta5
Introduced
2.4.0-beta6
Last affected
2.4.0-beta6
Introduced
2.4.0-beta7
Last affected
2.4.0-beta7
Introduced
2.4.0-beta8
Last affected
2.4.0-beta8
Introduced
2.4.0-beta9
Last affected
2.4.0-beta9
Introduced
2.5.0-beta1
Last affected
2.5.0-beta1
Introduced
2.5.0-beta2
Last affected
2.5.0-beta2
Introduced
2.5.0-beta3
Last affected
2.5.0-beta3
Introduced
2.5.0-beta4
Last affected
2.5.0-beta4
Introduced
2.5.0-beta5
Last affected
2.5.0-beta5
Introduced
2.5.0-beta6
Last affected
2.5.0-beta6
Introduced
2.5.0-beta7
Last affected
2.5.0-beta7
Introduced
2.6.0-beta1
Last affected
2.6.0-beta1
Introduced
2.6.0-beta2
Last affected
2.6.0-beta2
Introduced
2.6.0-beta3
Last affected
2.6.0-beta3
Introduced
2.6.0-beta4
Last affected
2.6.0-beta4
Introduced
2.6.0-beta5
Last affected
2.6.0-beta5
Introduced
2.6.0-beta6
Last affected
2.6.0-beta6
Introduced
2.7.0-beta1
Last affected
2.7.0-beta1
Introduced
2.7.0-beta2
Last affected
2.7.0-beta2
Introduced
2.7.0-beta3
Last affected
2.7.0-beta3
Introduced
2.7.0-beta4
Last affected
2.7.0-beta4
Introduced
2.7.0-beta5
Last affected
2.7.0-beta5
Introduced
2.7.0-beta6
Last affected
2.7.0-beta6
Introduced
2.7.0-beta7
Last affected
2.7.0-beta7
Introduced
2.7.0-beta8
Last affected
2.7.0-beta8
Introduced
2.7.0-beta9
Last affected
2.7.0-beta9
Introduced
2.8.0-beta1
Last affected
2.8.0-beta1
Introduced
2.8.0-beta10
Last affected
2.8.0-beta10
Introduced
2.8.0-beta11
Last affected
2.8.0-beta11
Introduced
2.8.0-beta2
Last affected
2.8.0-beta2
Introduced
2.8.0-beta3
Last affected
2.8.0-beta3
Introduced
2.8.0-beta4
Last affected
2.8.0-beta4
Introduced
2.8.0-beta5
Last affected
2.8.0-beta5
Introduced
2.8.0-beta6
Last affected
2.8.0-beta6
Introduced
2.8.0-beta7
Last affected
2.8.0-beta7
Introduced
2.8.0-beta8
Last affected
2.8.0-beta8
Introduced
2.8.0-beta9
Last affected
2.8.0-beta9
Introduced
2.9.0-beta1
Last affected
2.9.0-beta1
Introduced
2.9.0-beta10
Last affected
2.9.0-beta10
Introduced
2.9.0-beta11
Last affected
2.9.0-beta11
Introduced
2.9.0-beta12
Last affected
2.9.0-beta12
Introduced
2.9.0-beta13
Last affected
2.9.0-beta13
Introduced
2.9.0-beta14
Last affected
2.9.0-beta14
Introduced
2.9.0-beta2
Last affected
2.9.0-beta2
Introduced
2.9.0-beta3
Last affected
2.9.0-beta3
Introduced
2.9.0-beta4
Last affected
2.9.0-beta4
Introduced
2.9.0-beta5
Last affected
2.9.0-beta5
Introduced
2.9.0-beta6
Last affected
2.9.0-beta6
Introduced
2.9.0-beta7
Last affected
2.9.0-beta7
Introduced
2.9.0-beta8
Last affected
2.9.0-beta8
Introduced
2.9.0-beta9
Last affected
2.9.0-beta9
Introduced
3.0.0-beta15
Last affected
3.0.0-beta15