CVE-2021-41271

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse is a platform for community discussion. In affected versions a maliciously crafted request could cause an error response to be cached by intermediate proxies. This could cause a loss of confidentiality for some content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
discourse	discourse	< 2.7.10; >= 2.8.0, < 2.8.0.beta8

References

https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-hf6r-mc9j-hf4pThird Party Advisory
https://github.com/discourse/discourse/commit/2da0001965c6d8632d723c46ea5df9f22a1a23f1Patch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-hf6r-mc9j-hf4pThird Party Advisory

Timeline

Published: Nov 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412727.5Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations r CVE-2021-412734.3Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on CVE-2021-412748.8solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_CVE-2021-412758.8spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront frame CVE-2021-412767.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does CVE-2021-412777.5Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`CVE-2021-412785.7Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting da CVE-2021-412798.8BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privi CVE-2021-41286.5When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potent CVE-2021-412809.8Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installatio CVE-2021-412817.5Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repositor CVE-2021-412828.8diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in