CVE-2024-45051

HIGH8.2EPSS 0.11%

Bypass of email address validation via encoded email addresses in Discourse

發布日:2024/10/11修改日:2025/5/20

也稱為:GHSA-2vjv-pgh4-6rmqBIT-discourse-2024-45051

描述

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known workarounds for this vulnerability.

受影響套件(1)

Bitnami/discoursefrom 0, < 3.3.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

參考連結(2)

WEBhttps://github.com/discourse/discourse/security/advisories/GHSA-2vjv-pgh4-6rmq
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2024-45051