ByteOS Network

CVE Vulnerability Details :

CVE-2021-41140

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-19 Oct, 2021 | 18:05

Updated At-04 Aug, 2024 | 02:59

▼CVE Numbering Authority (CNA)

Reactions leak for secure category topics and private messages

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.

Affected Products

Vendor

Civilized Discourse Construction Kit, Inc.

Product

discourse-reactions

Versions

Affected

< 0.2

Problem Types

Type	CWE ID	Description
CWE	CWE-668	CWE-668: Exposure of Resource to Wrong Sphere

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://github.com/discourse/discourse-reactions/security/advisories/GHSA-9358-hwg5-jrmh	x_refsource_CONFIRM
https://github.com/discourse/discourse-reactions/commit/213d90b82fd15c4186ebc290fee18817d9727d0d	x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://github.com/discourse/discourse-reactions/security/advisories/GHSA-9358-hwg5-jrmh	x_refsource_CONFIRM x_transferred
https://github.com/discourse/discourse-reactions/commit/213d90b82fd15c4186ebc290fee18817d9727d0d	x_refsource_MISC x_transferred

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References