CVE-2024-56197
low-risk
Published 2025-02-04
Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the PM has been tagged. This issue has been patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. Users are advised to upgrade. Users unable to upgrade should remove all groups from the the "PM tags allowed for groups" option.
Do I need to act?
-
0.14% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.2/10
Low
NETWORK
/ HIGH complexity
Affected Vendors
References (1)
Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-xmgr-g9cp-v239
23
/ 100
low-risk
Severity
9/34 · Low
Exploitability
1/34 · Minimal
Exposure
13/34 · Low