Medium severity · published Oct 19, 2021
CVE-2021-41140
Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactions given by user to secure topics and private messages are visible. This issue is patched in version 0.2 of discourse-reaction. Users who are unable to update are advised to disable the Discourse-reactions plugin in admin panel.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Discourse Reactions · Discourse
before 0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41140
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41140
Patch
https://github.com/discourse/discourse-reactions/commit/213d90b82fd15c4186ebc290fee18817d9727d0d
Third Party Advisory
https://github.com/discourse/discourse-reactions/security/advisories/GHSA-9358-hwg5-jrmh
More from Discourse Reactions
3.5
CVE-2023-49098
Discourse-reactions is a plugin that allows user to add their reactions to the post