{"containers": {"cna": {"affected": [{"product": "discourse", "vendor": "discourse", "versions": [{"status": "affected", "version": "stable < 2.7.11"}, {"status": "affected", "version": "beta < 2.8.0.beta9"}, {"status": "affected", "version": "tests-passed < 2.8.0.beta9"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the \"Tags are visible only to the following groups\" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-01T19:35:17", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4"}, {"tags": ["x_refsource_MISC"], "url": "https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895"}], "source": {"advisory": "GHSA-pq2x-vq37-8522", "discovery": "UNKNOWN"}, "title": "Notifications leak in Discourse", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-43792", "STATE": "PUBLIC", "TITLE": "Notifications leak in Discourse"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "discourse", "version": {"version_data": [{"version_value": "stable < 2.7.11"}, {"version_value": "beta < 2.8.0.beta9"}, {"version_value": "tests-passed < 2.8.0.beta9"}]}}]}, "vendor_name": "discourse"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the \"Tags are visible only to the following groups\" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}]}, "references": {"reference_data": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522", "refsource": "CONFIRM", "url": "https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522"}, {"name": "https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4", "refsource": "MISC", "url": "https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4"}, {"name": "https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895", "refsource": "MISC", "url": "https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895"}]}, "source": {"advisory": "GHSA-pq2x-vq37-8522", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:03:08.901Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-43792", "datePublished": "2021-12-01T19:35:17", "dateReserved": "2021-11-16T00:00:00", "dateUpdated": "2024-08-04T04:03:08.901Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "matchCriteriaId": "3F845CD5-5BBB-4686-B459-F20DEC41748C", "versionEndExcluding": "2.7.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "9E7F8AC4-35D1-45E5-8A3A-B0205000A5D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "B9AE12FE-0396-4843-8D30-D8C44FAE01DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "F101AEAB-4FB7-4BE3-931B-595702D616C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "F6878B7F-2691-4D3F-8116-CB282FDAAAC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "76EABAB9-BEA4-48D4-ADBA-D00746B29C52", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta6:*:*:*:*:*:*", "matchCriteriaId": "82A255A2-4658-41AD-A4DE-A7F8D018028D", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta7:*:*:*:*:*:*", "matchCriteriaId": "E5804585-2EA4-4677-8EC1-5F561D5C7D7A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the \"Tags are visible only to the following groups\" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible."}, {"lang": "es", "value": "Discourse es una plataforma de debate de c\u00f3digo abierto. En las versiones afectadas, una vulnerabilidad afecta a usuarios de grupos de etiquetas que usan la funcionalidad \"Tags are visible only to the following groups\". Un grupo de etiquetas puede permitir a s\u00f3lo un determinado grupo (por ejemplo, el personal) visualizar determinadas etiquetas. Los usuarios que segu\u00edan o visualizaban las etiquetas por medio de /preferences/tags, y luego les es revocada su condici\u00f3n de personal, seguir\u00e1n viendo las notificaciones relacionadas con la etiqueta, pero no ver\u00e1n la etiqueta en cada tema. Este problema ha sido parcheado en la versi\u00f3n estable 2.7.11. Se recomienda a usuarios que se actualicen lo antes posible"}], "id": "CVE-2021-43792", "lastModified": "2022-07-25T10:36:53.613", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-12-01T20:15:08.433", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/discourse/discourse/commit/cdaf7f4bb3ec268238e4c29a14bb73fad56574b4"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-pq2x-vq37-8522"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://meta.discourse.org/t/non-forum-staff-getting-notifications-for-staff-only-tags/184895"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}