7.2

CVE-2022-36066

Discourse vulnerable to RCE via admins uploading maliciously zipped file

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Discourse ≫ Discourse Version < 2.8.9
Discourse ≫ Discourse Version 2.9.0 Update beta1
Discourse ≫ Discourse Version 2.9.0 Update beta2
Discourse ≫ Discourse Version 2.9.0 Update beta3
Discourse ≫ Discourse Version 2.9.0 Update beta4
Discourse ≫ Discourse Version 2.9.0 Update beta5
Discourse ≫ Discourse Version 2.9.0 Update beta6
Discourse ≫ Discourse Version 2.9.0 Update beta7
Discourse ≫ Discourse Version 2.9.0 Update beta8
Discourse ≫ Discourse Version 2.9.0 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.61% 0.735
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security-advisories@github.com 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://github.com/discourse/discourse/commit/b27d5626d208a22c516a0adfda7554b67b493835
Patch
Third Party Advisory
https://github.com/discourse/discourse/pull/18421
Patch
Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-grvh-qcpg-hfmv
Third Party Advisory