CVE-2022-21678

Status: ModifiedMedium (4.3)—

Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base score: 4.3

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.79%
Percentile among all scored CVEs: 55
Score date: 10/7/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Discourse — Discourse

CWEs

CWE-200
CWE-863

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2022-21678",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-21678",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T14:12:20.672874Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.7.13"
            },
            {
              "status": "affected",
              "version": "< 2.8.0.beta11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-13T18:15:08.233",
  "references": [
    {
      "url": "https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6de",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6c",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564m",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6de",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6c",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564m",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de debate de código abierto. En versiones anteriores a 2.8.0.beta11 en la rama \"tests-passed\", la versión 2.8.0.beta11 en la rama \"beta\", y la versión 2.7.13 en la rama \"stable\", las biografías de los usuarios que hacían sus perfiles privados seguían siendo visibles en las etiquetas \"(meta)\" de sus páginas de usuario. El problema está parcheado en la versión 2.8.0.beta11 de \"tests-passed\", la versión 2.8.0.beta11 de \"beta\" y la versión 2.7.13 de \"stable\" de Discourse"
    }
  ],
  "lastModified": "2026-06-17T04:26:44.707",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "131D6FC3-2C60-4524-9B4E-F8316312A606",
              "versionEndExcluding": "2.7.13"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E7F8AC4-35D1-45E5-8A3A-B0205000A5D3"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A24507D-6D4B-4992-BCFE-232AF3BFCC30"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9AE12FE-0396-4843-8D30-D8C44FAE01DA"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F101AEAB-4FB7-4BE3-931B-595702D616C7"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6878B7F-2691-4D3F-8116-CB282FDAAAC7"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76EABAB9-BEA4-48D4-ADBA-D00746B29C52"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82A255A2-4658-41AD-A4DE-A7F8D018028D"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5804585-2EA4-4677-8EC1-5F561D5C7D7A"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "082A6871-080A-4AA7-AF4A-D664EA46488A"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2.8.0:beta9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A280205-A2DC-4E30-937B-5564C779FD5A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}