CVE-2021-43794CWE-610

Anonymous user cache poisoning via development-mode header in Discourse

Medium · published December 1, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
64.0
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users, such that the users are shown a JSON blob instead of the HTML page. This can lead to a partial denial-of-service. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01050 · 64.0th percentile
Weakness
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere
Published
2021-12-01T19:40Z
EPSS history
Timeline
  • 01 DEC 19:40Z
    Anonymous user cache poisoning via development-mode header in Discourse
    cvelistv5