Exposición de Discourse

Message boards
94
score de exposición
2443
sitios usan
0
en explotación
2
críticos
Análisis Vexday

Com 248 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, o Discourse apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças confirmadas em produção. O tipo de falha mais recorrente é CWE-200 (exposição indevida de informações), indicando um padrão histórico de problemas relacionados ao controle de acesso a dados. A CVE mais perigosa no momento, CVE-2024-53991, registra EPSS de aproximadamente 0,25, valor que merece atenção dado que reflete probabilidade não trivial de exploração nos próximos 30 dias. O volume de 31 CVEs surgidas nos últimos 90 dias sinaliza cadência ativa de descobertas recentes, recomendando monitoramento contínuo do ciclo de atualização da plataforma.

CVEs

272 resultados
CVE-2023-22453MEDIUMDiscourse vulnerable to exposure of user post counts per topic to unauthorized usersEPSS 0.6%CVE-2022-23549MEDIUMDiscourse vulnerable to bypass of post max_length using HTML commentsEPSS 0.6%CVE-2023-22454HIGHDiscourse vulnerable to Cross-site Scripting through pending post titles descriptionsEPSS 0.6%CVE-2024-27085MEDIUMDenial of service through invites in DiscourseEPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2024-21655MEDIUMInsufficient control of custom field value sizesEPSS 0.6%CVE-2022-39356HIGHDiscourse user account takeover via email and invite linkEPSS 0.6%CVE-2024-27100MEDIUMDenial of service via Staff Actions in DiscourseEPSS 0.6%CVE-2023-28111MEDIUMDiscourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addressesEPSS 0.6%CVE-2021-32764HIGHYouTube Onebox susceptible to XSSEPSS 0.5%CVE-2023-37906MEDIUMDiscourse vulnerable to DoS via post edit reasonEPSS 0.5%CVE-2023-23622MEDIUMDiscourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all usersEPSS 0.5%CVE-2023-44388HIGHMalicious requests can fill up the log files resulting in a deinal of service in DiscourseEPSS 0.5%CVE-2023-25172MEDIUMDiscourse vulnerable to Cross-site Scripting - user name displayed on postEPSS 0.5%CVE-2022-46150MEDIUMDiscourse may allow exposure of hidden tags in the subject of notification emailsEPSS 0.5%CVE-2022-46168LOWGroup SMTP user emails are exposed in CC email headerEPSS 0.5%CVE-2022-39241HIGHPossible Server-Side Request Forgery (SSRF) in webhooksEPSS 0.5%CVE-2023-48297HIGHDiscourse vulnerable to unlimited mentioned users in message serializerEPSS 0.5%CVE-2023-40588MEDIUMDiscourse DoS via 2FA and Security Key NamesEPSS 0.5%CVE-2023-41043MEDIUMDiscourse DoS via SvgSprite cacheEPSS 0.5%