CVE-2022-21642

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this issue and users are advised to upgrade.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216439.8USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular us CVE-2022-216447.2USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search term CVE-2022-216468.1SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under th CVE-2022-216479.8CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgnit CVE-2022-216486.1Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has CVE-2022-216495.4Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> ta CVE-2022-21654.3Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing CVE-2022-216505.4Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload CVE-2022-216516.1Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirect CVE-2022-216528.1Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a CVE-2022-216537.5Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't over CVE-2022-216549.8Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation