CVE-2024-28242

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-28242
Discourse is an open source platform for community discussion. In affected versions an attacker can learn that secret categories exist when they have backgrounds set. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. Users unable to upgrade should temporarily remove category backgrounds.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 Patch
https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 Third Party Advisory
https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 Patch
https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:tests-passed:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:-:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:-:*:*:tests-passed:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:tests-passed:*:*:*
History

26 Aug 2025, 17:18

Type Values Removed Values Added
CPE cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:tests-passed:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:beta1:*:*:tests-passed:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:-:*:*:tests-passed:*:*:*
cpe:2.3:a:discourse:discourse:3.3.0:-:*:*:beta:*:*:*
cpe:2.3:a:discourse:discourse:*:*:*:*:beta:*:*:*
First Time Discourse discourse
Discourse
References () https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 - () https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 - Patch
References () https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 - () https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 - Third Party Advisory

21 Nov 2024, 09:06

Type Values Removed Values Added
References () https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 - () https://github.com/discourse/discourse/commit/b425fbc2a28341a5627928f963519006712c3d39 -
References () https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 - () https://github.com/discourse/discourse/security/advisories/GHSA-c7q7-7f6q-2c23 -
Summary
  • (es) Discourse es una plataforma de código abierto para el debate comunitario. En las versiones afectadas, un atacante puede descubrir que existen categorías secretas cuando tienen fondos configurados. El problema está solucionado en la última versión estable, beta y probada de Discourse. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar deben eliminar temporalmente los fondos de las categorías.

15 Mar 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-15 20:15

Updated : 2025-08-26 17:18

NVD link : CVE-2024-28242

Mitre link : CVE-2024-28242

CVE.ORG link : CVE-2024-28242

JSON object : View

Products Affected

discourse

  • discourse
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor