CVE-2022-36068 - Discourse moderators can edit themes via the API

Back Back to CVE browser

HIGH

Discourse moderators can edit themes via the API

Published Sep 29, 2022

7.2

HIGH

CVSS 3.1

EPSS 0.89%

Description

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

Affected products

Vendor Discourse Product Discourse Default
n/a
- Version
  < 2.8.9
  Status
  affected
  Constraints
  -
- Version
  >= 2.9.0.beta0, < 2.9.0.beta10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Discourse

n/a

Version	Status	Constraints
< 2.8.9	affected	-
>= 2.9.0.beta0, < 2.9.0.beta10	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://github.com/discourse/discourse/commit/ae1e536e83940d58f1c79b835c75c249121c46b6
x_refsource_MISCPatchThird Party Advisory
https://github.com/discourse/discourse/pull/18418
x_refsource_MISCPatchThird Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-6crr-3662-263q
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://github.com/discourse/discourse/commit/ae1e536e83940d58f1c79b835c75c249121c46b6		x_refsource_MISCPatchThird Party Advisory
https://github.com/discourse/discourse/pull/18418		x_refsource_MISCPatchThird Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-6crr-3662-263q		x_refsource_CONFIRMThird Party Advisory