CVE-2021-41140CWE-668

Reactions leak for secure category topics and private messages

Medium · published October 19, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00934 · 60.4th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2021-10-19T18:05Z
EPSS history
Timeline
  • 19 OCT 18:05Z
    Reactions leak for secure category topics and private messages
    cvelistv5