CVE-2022-36068

Discourse moderators can edit themes via the API

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.

We have discovered 813 live websites that are affected by CVE-2022-36068.

Contact us to get more info



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains813 live websites (15.56% of Discourse install base)
Vulnerable Versions
  • from 0 before 2.8.9
  • from 2.9 before 2.9
Vulnerable Versions Count65 versions ( 68.42% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Sep 30, 2022
  • Updated - Aug 3, 2024

CVE-2022-36068 usage by Country

United States544 websites


Germany67 websites
France37 websites
Singapore24 websites
China23 websites
GB17 websites
Brazil8 websites
Netherlands8 websites
Russia8 websites

CVE-2022-36068 usage by TLD

.com350 websites
.org129 websites
.io40 websites
.net32 websites
.de20 websites
.co13 websites
.fr10 websites
.ru9 websites
.eu8 websites
.com.br8 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2022-36068

Top websites that are affected by CVE-2022-36068. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.***.com France*,***
*********.*******.org United States**,***
******.********.com United States**,***
*********.***************.com United States**,***
*********.**********.io United States***,***
*********.****.ly United States***,***
*************.de United States***,***
*****.***********.com United States***,***
*************.com United States***,***
*********.*********.io United States***,***
See full domain list

FAQ

CVE-2022-36068 is Missing Authorization in Discourse
A total of 813 websites have been identified as vulnerable to CVE-2022-36068, discovered through global website indexing conducted by WebTechSurvey.
Discourse is susceptible to CVE-2022-36068 vulnerability.
Discourse versions before 2.9 are vulnerable to CVE-2022-36068.
Version 2.9 of Discourse addresses the CVE-2022-36068 security vulnerability.