Reactions on Whispers: A New Feature for Public Topics
CVE-2024-31219

4.3MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse-reactions
Vendor
CVE Published:
15 April 2024

What is CVE-2024-31219?

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via whispers_allowed_groups and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the /u/:username/activity/reactions endpoint.

Affected Version(s)

discourse-reactions < 0.5

References

https://github.com/discourse/discourse-reactions/security...
x_refsource_CONFIRM
https://github.com/discourse/discourse-reactions/commit/6...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.