MEDIUM🇬🇧 English

CVE-2025-61598

CVSS 6.3v4.0pub. 2025-10-28upd. 2025-12-03

Discourse is an open source discussion platform. Version before 3.6.2 and 3.6.0.beta2, default Cache-Control response header with value no-store, no-cache was missing from error responses. This may caused unintended caching of those responses by proxies potentially leading to cache poisoning attacks. This vulnerability is fixed in 3.6.2 and 3.6.0.beta2.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Discourse

    APP
    Discourse
    3.6.0< 3.5.2< 3.6.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2022-36066CRITICAL9.1ten sam produkt

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior t...

CVE-2021-41163CRITICAL10.0ten sam produkt

Discourse is an open source platform for community discussion. In affected versions maliciously crafted reques...

CVE-2026-29072HIGH8.2ten sam produkt

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, ...

CVE-2026-27934HIGH8.7ten sam produkt

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 h...

CVE-2026-26078HIGH7.5ten sam produkt

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the...