CVE-2021-37703

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta5, a user's read state for a topic such as the last read post number and the notification level is exposed.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
discourse	discourse	< 2.7.8

References

https://github.com/discourse/discourse/commit/aed65ec16d38886d7be7209d8c02df4ffd4937a4Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-gq2h-qhg2-phf9Third Party Advisory
https://github.com/discourse/discourse/commit/aed65ec16d38886d7be7209d8c02df4ffd4937a4Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-gq2h-qhg2-phf9Third Party Advisory

Timeline

Published: Aug 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-377044.3PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and CVE-2021-3770510.0OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization ch CVE-2021-377069.8PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2021-377077.5Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews CVE-2021-377089.8Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. V CVE-2021-377096.5Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object referen CVE-2021-377105.4Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. V CVE-2021-377118.8Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contain CVE-2021-377128.6The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code e CVE-2021-377138.6The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code e CVE-2021-377147.5jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable t CVE-2021-377154.8A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0. Aruba h