CVE-2022-39385

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39385
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39385.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39385
Aliases
Published
2022-11-14T00:00:00Z
Modified
2026-10-21T02:48:01Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Users erroneously and transparently added to private messages in Discourse
Details

Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message topics that they should not be added to. They are not notified of this, it happens transparently in the background. This issue has been resolved in commit a414520742 and will be included in future releases. Users are advised to upgrade. Users are also advised to set SiteSetting.max_invites_per_day to 0 until the patch is installed.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39385.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
ce28fd2e1d75162dc7dd78bacbe1233dcad9ff1d
Fixed
a414520742da8dc9dc976d4fb7b72dbd445813bb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "Stable: <= 2.8.10"
                },
                {
                    "last_affected":  "Stable: <= 2.8.10"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "Beta: <= 2.9.0.beta11"
                },
                {
                    "last_affected":  "Beta: <= 2.9.0.beta11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "a414520742da8dc9dc976d4fb7b72dbd445813bb"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.9.0-beta1
2.9.0-beta10
2.9.0-beta2
2.9.0-beta3
2.9.0-beta4
2.9.0-beta5
2.9.0-beta6
2.9.0-beta7
2.9.0-beta8
Beta: <= 2.*
Beta: <= 2.9.0.beta11
Stable: <= 2.*
Stable: <= 2.8.10

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39385.json"