CVE-2021-37693

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/discourse/discourse/commit/fb14e50741a4880cda22244eded8858e2f5336ef	Patch Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-9377-96f4-cww4	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse::::::::
	cpe:2.3:a:discourse:discourse:2.8.0:beta1::::::
	cpe:2.3:a:discourse:discourse:2.8.0:beta2::::::
	cpe:2.3:a:discourse:discourse:2.8.0:beta3::::::

History

No history.

Information

Published : 2021-08-13 16:15

Updated : 2021-08-30 18:01

NVD link : CVE-2021-37693

Mitre link : CVE-2021-37693

CVE.ORG link : CVE-2021-37693

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-613

Insufficient Session Expiration

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2021-37693", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2021-08-13T16:15:07.717", "references": [{"url": "https://github.com/discourse/discourse/commit/fb14e50741a4880cda22244eded8858e2f5336ef", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-9377-96f4-cww4", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}, {"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification process. Deleting the additional email address does not invalidate an unused token which can then be used in other contexts, including reseting a password."}, {"lang": "es", "value": "Discourse es una plataforma de c\u00f3digo abierto para el debate comunitario. En Discourse versiones anteriores a 2.7.8 y 2.8.0.beta4, cuando se a\u00f1aden direcciones de correo electr\u00f3nico adicionales a una cuenta existente en un sitio de Discourse es generado un token de correo electr\u00f3nico como parte del proceso de comprobaci\u00f3n del correo electr\u00f3nico. Eliminando las direcciones de correo electr\u00f3nico adicionales no invalida un token no usado que puede ser usado en otros contextos, incluyendo el restablecimiento de una contrase\u00f1a."}], "lastModified": "2021-08-30T18:01:10.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A85C6E2-A78D-47B2-AE03-A12AE6A2E8BD", "versionEndExcluding": "2.7.8"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E7F8AC4-35D1-45E5-8A3A-B0205000A5D3"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9AE12FE-0396-4843-8D30-D8C44FAE01DA"}, {"criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F101AEAB-4FB7-4BE3-931B-595702D616C7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}