Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error responses to be cached by Discourse's default NGINX proxy configuration. A corrected NGINX configuration is included in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
Link | Resource |
---|---|
https://github.com/discourse/discourse/commit/7af25544c3940c4d046c51f4cfac9c72a06d4f50 | Patch Third Party Advisory |
https://github.com/discourse/discourse/security/advisories/GHSA-4ff8-3j78-w6pp | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2022, 15:22
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://github.com/discourse/discourse/commit/7af25544c3940c4d046c51f4cfac9c72a06d4f50 - Patch, Third Party Advisory | |
References | (CONFIRM) https://github.com/discourse/discourse/security/advisories/GHSA-4ff8-3j78-w6pp - Third Party Advisory | |
CPE | cpe:2.3:a:discourse:discourse:2.9.0:beta7:*:*:*:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
01 Aug 2022, 20:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-08-01 20:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-31182
Mitre link : CVE-2022-31182
CVE.ORG link : CVE-2022-31182
JSON object : View
Products Affected
discourse
- discourse
CWE
CWE-404
Improper Resource Shutdown or Release