CVE-2024-36122 json
Discourse doesn't limit reviewable user serializer payload
published 2024-07-03 2 y ago modified 2026-09-08 2 mo ago also BIT-discourse-2024-36122 , EUVD-2024-35889 , GHSA-rr93-hcw4-cv3f
- cvss
- 2.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches, moderators using the review queue to review users may see a users email address even when the Allow moderators to view email addresses setting is disabled. This issue is patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta4 on the `beta` and `tests-passed` branches. As possible workarounds, either prevent moderators from accessing the review queue or disable the approve suspect users site setting and the must approve users site setting to prevent users from being added to the review queue.
Patch / fix
- bitnami discourse 3.2.3
- discourse discourse 3.2.3, 3.3.0.beta4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <3.2.3 |
3.2.3 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/discourse/discourse/commit/8d5b21170efa4766e1a213ff07dc36d36cf3dfb4
patch
-
github.com
/discourse/discourse/commit/e2a7265dba3d9e943338db21ca38c50276b22f47
patch
-
github.com
/discourse/discourse/security/advisories/GHSA-rr93-hcw4-cv3f
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-36122
web
Sources
- CVE List CVE-2024-36122
- NVD CVE-2024-36122
- OSV BIT-discourse-2024-36122
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.