CVE-2024-24755CWE-200

discourse-group-membership-ip-block is exposing potentially sensitive custom fields

Medium · published February 1, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other plugins which may expect their custom fields to remain secret.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-02-01T22:14Z
EPSS history
Timeline
  • 01 FEB 22:14Z
    discourse-group-membership-ip-block is exposing potentially sensitive custom fields
    cvelistv5