FKIE_CVE-2022-31184

Vulnerability from fkie_nvd - Published: 2022-08-01 20:15 - Updated: 2024-11-21 07:04
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email.
References
security-advisories@github.comhttps://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrfThird Party Advisory
Impacted products
Vendor Product Version
discourse discourse *
discourse discourse 2.9.0
discourse discourse 2.9.0
discourse discourse 2.9.0
discourse discourse 2.9.0
discourse discourse 2.9.0
discourse discourse 2.9.0
discourse discourse 2.9.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6A1B91-52FA-4FFE-96D0-DC25865E15FD",
              "versionEndIncluding": "2.8.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "B3803EF9-A296-42B7-887F-93C5E68E94C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "8BA3D313-3C11-43E2-A47D-CBB532D1B6F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "6F42673E-65F3-4807-9484-20CB747420FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "0B91D023-FCE5-4866-AD8B-BBB675763104",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "0086484D-0164-449C-8AAE-BE7479CB9706",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "F9D1B031-96C7-44C0-A0A0-F67ABE55C93C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:*",
              "matchCriteriaId": "750D2AD9-35E7-4AC7-9C22-AA90DAA34F3F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta and tests-passed versions of Discourse which rate limits emails. Users are advised to upgrade. Users unable to upgrade should manually rate limit email."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. En las versiones afectadas puede abusarse de una ruta de activaci\u00f3n del correo electr\u00f3nico para enviar correos masivos de spam. Ha sido incluida una correcci\u00f3n en las \u00faltimas versiones estables, beta y de prueba de Discourse que limita los correos electr\u00f3nicos. Es recomendado a usuarios actualizar. Los usuarios que no puedan actualizarse deber\u00e1n limitar manualmente la tasa de los correos electr\u00f3nicos"
    }
  ],
  "id": "CVE-2022-31184",
  "lastModified": "2024-11-21T07:04:04.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-08-01T20:15:08.467",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/discourse/discourse/commit/af1cb735db7fb73217b85d22dbadd1bc824ac0b0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-m5w9-8gp8-2hrf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.