CVE-2022-46177 json
Discourse password reset link can lead to in account takeover if user changes to a new email
published 2023-01-05 3 y ago modified 2026-09-08 2 mo ago also BIT-discourse-2022-46177 , EUVD-2022-48998 , GHSA-5www-jxvf-vrc3
- cvss
- 5.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 3.0.0.beta16 on the `beta` and `tests-passed` branches, when a user requests for a password reset link email, then changes their primary email, the old reset email is still valid. When the old reset email is used to reset the password, the Discourse account's primary email would be re-linked to the old email. If the old email address is compromised or has transferred ownership, this leads to an account takeover. This is however mitigated by the SiteSetting `email_token_valid_hours` which is currently 48 hours. Users should upgrade to versions 2.8.14 or 3.0.0.beta15 to receive a patch. As a workaround, lower `email_token_valid_hours ` as needed.
Patch / fix
- bitnami discourse 2.8.14
- discourse discourse 2.8.14
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.7 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <2.8.14 |
2.8.14 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/discourse/discourse/commit/4bf306f0e3bf54a9ef9c5886bf1cfb85c20da570
patch, third-party-advisory, advisory
-
github.com
/discourse/discourse/commit/83944213b2b2454af80d0407f60d67641b1f0b38
patch, third-party-advisory, advisory
-
github.com
/discourse/discourse/security/advisories/GHSA-5www-jxvf-vrc3
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-46177
web
Sources
- CVE List CVE-2022-46177
- NVD CVE-2022-46177
- OSV BIT-discourse-2022-46177
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.