CVE-2022-24782

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24782
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24782.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24782
Aliases
Published
2022-03-24T20:35:10Z
Modified
2026-10-28T02:30:25Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Secure category names leaked via user activity export in Discourse
Details

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the main branch of Discourse's GitHub repository and is anticipated to be part of future releases.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24782.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
74ce2fe2e7caec7dd55fadc9cd3b785c4b5f7933
Fixed
9d5737fd28374cc876c070f6c3a931a8071ec356
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "stable <= 2.8.2"
                },
                {
                    "last_affected":  "stable <= 2.8.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "beta <= 2.9.0.beta3"
                },
                {
                    "last_affected":  "beta <= 2.9.0.beta3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "tests-passed <= 2.9.0.beta3"
                },
                {
                    "last_affected":  "tests-passed <= 2.9.0.beta3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "9d5737fd28374cc876c070f6c3a931a8071ec356"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

beta <= 2.*
beta <= 2.9.0.beta3
stable <= 2.*
stable <= 2.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24782.json"