CVE-2024-49765CWE-359

Bypass of Discourse Connect using other login paths if enabled in Discourse

Medium · published December 19, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2024-12-19T19:15Z
EPSS history
Timeline
  • 19 DEC 19:15Z
    Bypass of Discourse Connect using other login paths if enabled in Discourse
    cvelistv5