CVE-2024-45051

HIGH8.2EPSS 0.11%

Bypass of email address validation via encoded email addresses in Discourse

Published: 10/11/2024Modified: 5/20/2025

Also known as:GHSA-2vjv-pgh4-6rmqBIT-discourse-2024-45051

Description

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages (1)

Bitnami/discoursefrom 0, < 3.3.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References (2)

WEBhttps://github.com/discourse/discourse/security/advisories/GHSA-2vjv-pgh4-6rmq
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2024-45051