CVE-2022-24804

Private group name exposure in discourse

Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permissions setting.

We have discovered 798 live websites that are affected by CVE-2022-24804.

Contact us to get more info



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains798 live websites (15.28% of Discourse install base)
Vulnerable Versions
  • from 0 before 2.8.3
  • from 2.9 before 2.9
Vulnerable Versions Count59 versions ( 62.11% of all versions)


Common Weakness Enumeration

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor



Details

  • Published - Apr 12, 2022
  • Updated - Aug 3, 2024

CVE-2022-24804 usage by Country

United States535 websites


Germany63 websites
France37 websites
Singapore24 websites
China22 websites
GB17 websites
Brazil8 websites
Netherlands8 websites
Russia8 websites

CVE-2022-24804 usage by TLD

.com344 websites
.org128 websites
.io38 websites
.net32 websites
.de20 websites
.co13 websites
.fr10 websites
.eu8 websites
.com.br8 websites
.ru8 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-24804

Top websites that are affected by CVE-2022-24804. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.***.com France*,***
*********.*******.org United States**,***
******.********.com United States**,***
*********.***************.com United States**,***
*********.****.ly United States***,***
*************.de United States***,***
*****.***********.com United States***,***
*************.com United States***,***
*********.*********.io United States***,***
*****.org United States***,***
See full domain list

FAQ

CVE-2022-24804 is Exposure of Sensitive Information to an Unauthorized Actor in Discourse
A total of 798 websites have been identified as vulnerable to CVE-2022-24804, discovered through global website indexing conducted by WebTechSurvey.
Discourse is susceptible to CVE-2022-24804 vulnerability.
Discourse versions before 2.9 are vulnerable to CVE-2022-24804.
Version 2.9 of Discourse addresses the CVE-2022-24804 security vulnerability.