fkie_cve-2024-53991
Vulnerability from fkie_nvd
Published
2024-12-19 20:15
Modified
2024-12-19 20:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade can either 1. Download all local backups on to another storage device, disable the `enable_backups` site setting and delete all backups until the site has been upgraded to pull in the fix. Or 2. Change the `backup_location` site setting to `s3` so that backups are stored and downloaded directly from S3.
References
security-advisories@github.comhttps://github.com/discourse/discourse/security/advisories/GHSA-567m-82f6-56rv
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade can either 1. Download all local backups on to another storage device, disable the `enable_backups` site setting and delete all backups until the site has been upgraded to pull in the fix. Or  2. Change the `backup_location` site setting to `s3` so that backups are stored and downloaded directly from S3."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de c\u00f3digo abierto para debates comunitarios. Esta vulnerabilidad solo afecta a las instancias de Discourse configuradas para usar `FileStore::LocalStore`, lo que significa que las cargas y las copias de seguridad se almacenan localmente en el disco. Si un atacante conoce el nombre del archivo de copia de seguridad de Discourse, puede enga\u00f1ar a nginx para que env\u00ede el archivo de copia de seguridad de Discourse con una solicitud bien manipulada. Este problema est\u00e1 parcheado en las \u00faltimas versiones estables, beta y de pruebas aprobadas de Discourse. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden 1. Descargar todas las copias de seguridad locales en otro dispositivo de almacenamiento, deshabilitar la configuraci\u00f3n del sitio `enable_backups` y eliminar todas las copias de seguridad hasta que el sitio se haya actualizado para incorporar la soluci\u00f3n. O 2. Cambiar la configuraci\u00f3n del sitio `backup_location` a `s3` para que las copias de seguridad se almacenen y descarguen directamente desde S3."
    }
  ],
  "id": "CVE-2024-53991",
  "lastModified": "2024-12-19T20:15:07.670",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-19T20:15:07.670",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-567m-82f6-56rv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.