CVE Vulnerability

CVE-2022-39355

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number 846d012151514b35ce42a1636c7d70f6dcee879e of the discourse-patreon plugin. Out of an abundance of caution, any Discourse accounts which have logged in with an unverified-email Patreon account will be logged out and asked to verify their email address on their next login. As a workaround, disable the patreon integration and log out all users with associated Patreon accounts.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/discourse/discourse-patreon/commit/846d012151514b35ce42a1636c7d70f6dcee879e Patch Third Party Advisory
https://github.com/discourse/discourse-patreon/security/advisories/GHSA-fvj9-f67v-qpr4 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:discourse:patreon:*:*:*:*:*:*:*:*
Information

Published : 2022-10-26 08:15

Updated : 2022-10-28 07:39

NVD link : CVE-2022-39355

Mitre link : CVE-2022-39355

Products Affected
No products.
CWE
CWE-287