CVE-2022-21678

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and version 2.7.13 in the `stable` branch, the bios of users who made their profiles private were still visible in the `<meta>` tags on their users' pages. The problem is patched in `tests-passed` version 2.8.0.beta11, `beta` version 2.8.0.beta11, and `stable` version 2.7.13 of Discourse.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-863

Affected software

Vendor	Product	Versions
discourse	discourse	< 2.7.13; < 2.8.0.beta11

References

https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6dePatch, Third Party Advisory
https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6cPatch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564mPatch, Third Party Advisory
https://github.com/discourse/discourse/commit/5e2e178fcfb490c37b9f8bb9f737185441b1d6dePatch, Third Party Advisory
https://github.com/discourse/discourse/commit/c0bb775f3f35b1b0d04a5b2a984f57c3e39f9e6cPatch, Third Party Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-jwww-46gv-564mPatch, Third Party Advisory

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216799.8Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and n CVE-2022-21686.1The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history CVE-2022-216807.5Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking ag CVE-2022-216817.5Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic back CVE-2022-216826.5Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.CVE-2022-216834.3Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in commen CVE-2022-216848.8Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-pa CVE-2022-216856.5Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's CVE-2022-216869.8PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inje CVE-2022-216876.5gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerabil CVE-2022-216885.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor net CVE-2022-216897.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor net