CVE-2024-31219 Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page
Attackers can view private whisper content and reaction data on public user activity pages if whispers are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-31219?
CVE-2024-31219 is a medium-severity vulnerability in discourse-reactions, published on 15 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.
Weakness: CWE-200
Which versions are affected by CVE-2024-31219?
How do I fix CVE-2024-31219?
No fix has been published for CVE-2024-31219 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-31219 being exploited?
There is no known exploitation of CVE-2024-31219 in the wild and no public exploit code.
Sources
Also known as GHSA-7cqc-5xrw-xh67.