CVE-2021-3138

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/162256/Discourse-2.7.0-2FA-Bypass.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/Mesh3l911/DisourceThird Party Advisory
https://github.com/discourse/discourse/releasesRelease Notes, Third Party Advisory
http://packetstormsecurity.com/files/162256/Discourse-2.7.0-2FA-Bypass.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/Mesh3l911/DisourceThird Party Advisory
https://github.com/discourse/discourse/releasesRelease Notes, Third Party Advisory

Timeline

Published: Jan 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-313805.3A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send CVE-2021-313819.1A configuration weakness in the JBoss Application Server (AppSvr) component of Juniper Networks SRC Series allows a remote attacker to send CVE-2021-313829.0On PTX1000 System, PTX10002-60C System, after upgrading to an affected release, a Race Condition vulnerability between the chassis daemon (c CVE-2021-313837.5In Point to MultiPoint (P2MP) scenarios within established sessions between network or adjacent neighbors the improper use of a source to de CVE-2021-3138410.0Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability e CVE-2021-313858.8An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in J-Web of Juniper Networks Junos OS allows CVE-2021-313865.9A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker CVE-2021-31398.1In Open-iSCSI tcmu-runner 1.3.x, 1.4.x, and 1.5.x through 1.5.2, xcopy_locate_udev in tcmur_cmd_handler.c lacks a check for transport-layer CVE-2021-313995.9On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack.CVE-2021-314007.5An issue was discovered in tcp_pulloutofband() in tcp_in.c in HCC embedded InterNiche 4.0.1. The TCP out-of-band urgent-data processing func CVE-2021-314017.5An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn't sanitize the value CVE-2021-314027.5The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-202