Vulnerability · Published Dec 19, 2024 · Assigned by GitHub_M

CVE-2024-52589Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Low 2.2

In plain English

A low-severity information exposure in discourse from discourse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)2.2Low

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.

Affected products (as reported)

Vendor	Product	Versions
discourse	discourse	stable: <= 3.3.2beta: <= 3.4.0.beta2tests-passed: <= 3.4.0.beta2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff x_refsource_CONFIRM