CVE-2024-24748

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Discourse is an open source platform for community discussion. In affected versions an attacker can learn that a secret subcategory exists under a public category which has no public subcategories. The issue is patched in the latest stable, beta and tests-passed version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
discoursediscoursestable <= 3.2.0; beta <= 3.3.0.beta1; tests-passed <= 3.3.0.beta1
discoursediscourse>= stable, <= 3.2.0; >= beta, <= 3.3.0.beta1; >= tests-passed, <= 3.3.0.beta1

References

Timeline

Published
Mar 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-247497.5GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer isCVE-2024-24755.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions upCVE-2024-247506.5Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming bodCVE-2024-247518.8sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existiCVE-2024-247526.5Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterCVE-2024-247536.5Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multipCVE-2024-247549.8Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterCVE-2024-247555.3discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-CVE-2024-247567.5Crafatar serves Minecraft avatars based on the skin for use in external applications. Files outside of the `lib/public/` directory can be reCVE-2024-247579.8open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when workiCVE-2024-247584.5Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but CVE-2024-247599.1MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the s