CVE-2024-31219

Published: Apr 15, 2024Modified: Jun 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/discourse/discourse-reactions/commit/6a5a8dacd7e5cbbbbe7d2288b1df9c1062994dbe

Source: security-advisories@github.com

https://github.com/discourse/discourse-reactions/security/advisories/GHSA-7cqc-5xrw-xh67

Source: security-advisories@github.com

https://github.com/discourse/discourse-reactions/commit/6a5a8dacd7e5cbbbbe7d2288b1df9c1062994dbe

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/discourse/discourse-reactions/security/advisories/GHSA-7cqc-5xrw-xh67

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.